lucastealer | 3c929d7c2dfe5638f93422aa26f6b6ef06624d0f8daa49887db9aac351d7b9d4

General

Target

Cryptor/Cryptor.exe
Size

1.4MB
MD5

be8d7f63ae91ef58a4853e9c5de5a5ff
SHA1

939236b40db18617f1dc9c603d50338f1145fdf7
SHA256

8f992b2af11e47c2bb264da9ee9089a90b9aa3566513d8e9128a4d0972d99724
SHA512

bfac67fd683ef0dc433c42cfce0066933344f728fe93b4cc9aeec30af27402f959534fb04fd5ca0fc2e4bfa87732091368b96b3340730c210dae6e480d0c1262
SSDEEP

24576:u4S0Ghs4lzScgXF+7LHYo1wT/nQiHQTeSQzhEdCf9AGwAFbEEvtIwH9vx4mb5xpN:rrGWESTVpoO/nkSJzhEm9brvKwH9amJN

Score

10^/10

lucastealer credential_access execution spyware stealer upx

Malware Config

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 1 IoCs

resource	yara_rule
behavioral4/memory/3820-103-0x00007FF7D1850000-0x00007FF7D1B6C000-memory.dmp	family_lucastealer

Lucastealer family
lucastealer
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/3820-0-0x00007FF7D1850000-0x00007FF7D1B6C000-memory.dmp	upx
behavioral4/memory/3820-103-0x00007FF7D1850000-0x00007FF7D1B6C000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3492	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3492	powershell.exe
3492	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3492	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 3492	3820	Cryptor.exe	83
PID 3820 wrote to memory of 3492	3820	Cryptor.exe	83

C:\Users\Admin\AppData\Local\Temp\Cryptor\Cryptor.exe
"C:\Users\Admin\AppData\Local\Temp\Cryptor\Cryptor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5X7ZnBo6tB0O7zyKPSjUH6YlZrkwRN\sensfiles.zip

Filesize
6.2MB

MD5
7d998f4092e9354ab33f435b677e731a

SHA1
209eeb6300ea5d85d2d463f37e72db2a71e1ac37

SHA256
657fb5cf48a0999197265169a3a7d15532e15fcceeb133d6753a43d28aa048ec

SHA512
50d2c24fa2ec30776ee5c41eae899460e9745304f0a6492d536a7cb75eb19f938cc94ecdc5e1a03eb8d7ac133131700260d7ccf04c2e935c01bd78bc647ba669

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mvhsy2kl.ktk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bravesoftware_default_login_data

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\chromium_default_login_data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\chromium_default_webdata

Filesize
114KB

MD5
0163d73ac6c04817a0bed83c3564b99f

SHA1
784001e8d0e7ab6a09202c2a1094f371f7d017cb

SHA256
5114af822abc2b0f2aabb7565919164c9babf884e34c21095213dbe6a71511ea

SHA512
47051ee935be9e9d4457447c7fe5df06a5b0c5ef55d2c757d3dfa179b6049ae79732b1552e812febe5ae41a076cb29d8a809ae9b168afc7eb4c9eadfadcf5d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\chromium_network_cookies

Filesize
20KB

MD5
ca4fb74cc41f5e23584aed59e9b00d29

SHA1
c535853441e2a9d4a50b2c7c1f53442e06e28314

SHA256
1779ae7fbe5f4882b8600a85663b882d82e1f94336f5eea3a9d75b943e345bc2

SHA512
1f047f7f2606a1a8a94aa78982414faf1dbf1abecf3abb8dd3f403ef76f6533c6f697355774cf3dea0c54444f682b66a297eee40277f9f4762460356627a9a08

Download Submit
memory/3492-11-0x0000017FFB050000-0x0000017FFB072000-memory.dmp

Filesize
136KB

Download
memory/3492-18-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Filesize
10.8MB

Download
memory/3492-17-0x0000017FFB1E0000-0x0000017FFB3FC000-memory.dmp

Filesize
2.1MB

Download
memory/3492-13-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Filesize
10.8MB

Download
memory/3492-12-0x00007FFCCA250000-0x00007FFCCAD11000-memory.dmp

Filesize
10.8MB

Download
memory/3492-1-0x00007FFCCA253000-0x00007FFCCA255000-memory.dmp

Filesize
8KB

Download
memory/3820-0-0x00007FF7D1850000-0x00007FF7D1B6C000-memory.dmp

Filesize
3.1MB

Download
memory/3820-103-0x00007FF7D1850000-0x00007FF7D1B6C000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing