eca457c7e9258b7526c10dda70afb96f7af73718c19c4ede894cc40e56af77fa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-25_27b2027f92ca66969c3f2449010aba5c_avoslocker_cobalt-strike_luca-stealer.exe
Size

270KB
MD5

27b2027f92ca66969c3f2449010aba5c
SHA1

f4fc8e43ad5d15c3781c7b0812a3663d55c98643
SHA256

eca457c7e9258b7526c10dda70afb96f7af73718c19c4ede894cc40e56af77fa
SHA512

98c6b55170cedc5b1d27cc8775b1d2acd023d20956767bfe3b96cbe88ceb56abe042d575b66539fe7fb11aa43cf5978a3ce66b60534bb638468fbff4692a4689
SSDEEP

6144:tDOnyhORl/hfUStnsjngPq+Ar32coTinSReWYfpuyt4pxdmqxFB:tDIyhORl/pUSNsjngPMr3JoTimYfpuyE

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-25_27b2027f92ca66969c3f2449010aba5c_avoslocker_cobalt-strike_luca-stealer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2025-01-25_27b2027f92ca66969c3f2449010aba5c_avoslocker_cobalt-strike_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2025-01-25_27b2027f92ca66969c3f2449010aba5c_avoslocker_cobalt-strike_luca-stealer.exe

C:\Users\Admin\AppData\Local\Temp\2025-01-25_27b2027f92ca66969c3f2449010aba5c_avoslocker_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-25_27b2027f92ca66969c3f2449010aba5c_avoslocker_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\buBGjbgD\_Files\_Information.txt

Filesize
1KB

MD5
ec51758b97e001ba368932b5120b0c78

SHA1
17f79cba30847eaf1fefade92875bab745227434

SHA256
41452a6ee08d638dbc8ba76dd0a0856620de854dea84b4f9c9f333b259108010

SHA512
ea336a83421bde1f65ae006a61d01cc4c8a6a4159f24f0d3cfb37f76e67612cff375ea680610d58b6b2a65b4fe166e7eb89165638f175ebf9fe2fcfa5dae0a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\buBGjbgD\_Files\_Information.txt

Filesize
5KB

MD5
73ee7538384172a68dd852643268c5e0

SHA1
53f0219c02cdf981bd9d692af69f64e79b38a033

SHA256
582cb92cd5c10149cef4cdab5150a5a7db887db98084eb9604ad27d93eb22e4a

SHA512
c3d8f3b83857cf9ddc7d621a0dcdb7c4f455599cf2281556d043f0a7704bfe247e20ab79fbabdd95545a19ff0455e21c4cb401c12a27412ee287a3b31f781f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\buBGjbgD\_Files\_Screen_Desktop.jpeg

Filesize
56KB

MD5
f1b9e727dd1363046d56b311c296a381

SHA1
179f13513b570120ec67b652a289812e877cc7a5

SHA256
ffb2cf5f6c8a9cb8056d88981cea223b9a177bba29adb9a5a389c0d5d7821983

SHA512
e02ee24020dbe3db0ce6d7198140d0d79cea8283c5c5283d04521e6eaf35bb3956f3e582e1d657e89718d58af87b6aa02f7d8eeef82acc62735a0e174d1b6b1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\buBGjbgD\gLXRcSbXOHWgl.zip

Filesize
59KB

MD5
c44c4f00cc4a756c44aa8c95eb47675e

SHA1
b462e1b8c8cd87ea1cc41554e46abb916e6e7530

SHA256
5164a940a1030ced9b50a5a11462f2a37818231ec7d99dc15d11029510e2e3e9

SHA512
a3aa81b393edee28205d05ea5f2879b8829718a0856d38f1ea92b3df189896a69196cefc13ef35f1d1a21aaeb2fc7acd16ffad31f2ce66289e5fd42f5e6b7f67

Download Submit