Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-01-2025 10:32
General
-
Target
2025-01-29_8a275265a27f6426cc9f1ea0b0e24bcf_inc_luca-stealer.exe
-
Size
161KB
-
MD5
8a275265a27f6426cc9f1ea0b0e24bcf
-
SHA1
4e2811cc56fc29f5369377714311089220f88123
-
SHA256
7c90ccd17fa69843cf4230d9206d2904303d826f3455289f1e514b0c948fcb28
-
SHA512
1dae5ec3e3809004d5c06b47a0d8f7632bc091733b23e40cf3bf6d11769bde1b05795110e370271a1637f9dffd1c79ded7c33148cefc374d6e7c10e7b814b2b0
-
SSDEEP
3072:YduKWsRRjHRvsfdO3Q+rSBPJasYIeuvuaEkZSc5:bYjHiqrrT1WUc5
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\Adobe\INC-README.txt
Family
inc_ransom
Ransom Note
~~~~ INC Ransom ~~~~
-----> Your data is stolen and encrypted.
If you don't pay the ransom, the data will be published on our TOR darknet sites.
The sooner you pay the ransom, the sooner your company will be safe.
Tor Browser Link:
http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/
http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/
Link for normal browser:
http://incapt.su/
-----> What guarantees are that we won't fool you?
We are not a politically motivated group and we want nothing more than money.
If you pay, we will provide you with decryption software and destroy the stolen data.
After you pay the ransom, you will quickly restore your systems and make even more money.
Treat this situation simply as a paid training for your system administrators, because it is due to your corporate network not being properly configured that we were able to attack you.
Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and pay for it.
If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future.
You can get more information about us on Twitter https://twitter.com/hashtag/incransom?f=live
-----> You need to contact us on TOR darknet sites with your personal ID
Download and install Tor Browser https://www.torproject.org/
Write to the chat room and wait for an answer, we'll guarantee a response from you.
Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack tens of companies around the world.
Tor Browser Link for chat:
http://incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion/
Your personal ID:
6798fffa038775d378498b0a
-----> Warning! Don't delete or modify encrypted files, it will lead to problems with decryption of files!
-----> Don't go to the police or the FBI for help. They won't help you.
The police will try to prohibit you from paying the ransom in any way.
The first thing they will tell you is that there's no guarantee to decrypt your files and remove stolen files.
This is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it's a matter of our reputation.
Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees.
The police and the FBI don't care what losses you suffer as a result of our attack, and we'll help you get rid of all your problems for a modest sum of money.
If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom.
The police and FBI won't be able to stop lawsuits from your customers for leaking personal and private information.
The police and FBI won't protect you from repeated attacks.
-----> Don't go to recovery companies!
They are essentially just middlemen who will make money off you and cheat you.
We are well aware of cases where recovery companies tell you that the ransom price is $5M dollars, but in fact they secretly negotiate with us for $1M.
If you approached us directly without intermediaries you would pay several times less.
-----> For those who have cyber insurance against ransomware attacks.
Insurance companies require you to keep your insurance information secret.
In most cases, we find this information and download it.
-----> If you do not pay the ransom, we will attack your company again in the future.
URLs
http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/
http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/
http://incapt.su/
https://twitter.com/hashtag/incransom?f=live
http://incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion/
Extracted
Path
C:\ProgramData\Adobe\INC-README.html
Ransom Note
<html>
<head>
<title>INC Ransom</title>
</head>
<body style="width: 100%; height: 100%; display: flex; flex-direction: column; justify-content: center; align-items: center; overflow: hidden;">
<div style="display: flex; justify-content: space-between; max-width: 80%; overflow-y: auto;">
<div style="width: 80%;">
<div style="display: flex; flex-direction: column;">
<span style="font-size: 20px; font-weight: 600;">Your data is stolen and encrypted.</span>
<span style="font-size: 14px; margin-top: 8px;">If you don't pay the ransom, the data will be published on our TOR darknet sites.</span>
<span style="font-size: 14px;">The sooner you pay the ransom, the sooner your company will be safe.</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">Blog Tor Browser Link:</span>
<span style="font-size: 14px; margin-top: 8px; text-decoration: underline;">http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/</span>
<span style="font-size: 14px; margin-top: 8px; text-decoration: underline;">http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">Blog Link for normal browser:</span>
<span style="font-size: 14px; margin-top: 8px; text-decoration: underline;">http://incapt.su/</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">You need to contact us on TOR darknet sites with your personal ID</span>
<span style="font-size: 14px; margin-top: 8px;">Download and install Tor Browser https://www.torproject.org/</span>
<span style="font-size: 14px; margin-top: 8px;">Write to the chat room and wait for an answer, we'll guarantee a response from you.</span>
<span style="font-size: 14px; margin-top: 8px;">Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack tens of companies around the world.</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">Chat Tor Browser Link:</span>
<span style="font-size: 14px; margin-top: 8px; text-decoration: underline;">http://incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion/</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">Your personal ID: </span>
<span style="font-size: 14px; margin-top: 8px; text-decoration: underline;">6798fffa038775d378498b0a</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">Don't go to recovery companies!</span>
<span style="font-size: 14px; margin-top: 8px;">They are essentially just middlemen who will make money off you and cheat you.</span>
<span style="font-size: 14px; margin-top: 8px;">We are well aware of cases where recovery companies tell you that the ransom price is $5M dollars, but in fact they secretly negotiate with us for $1M.</span>
<span style="font-size: 14px; margin-top: 8px;">If you approached us directly without intermediaries you would pay several times less.</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">For those who have cyber insurance against ransomware attacks.</span>
<span style="font-size: 14px; margin-top: 8px;">Insurance companies require you to keep your insurance information secret.</span>
<span style="font-size: 14px; margin-top: 8px;">In most cases, we find this information and download it.</span>
</div>
</div>
<div style="width: 80%;">
<div style="display: flex; flex-direction: column;">
<span style="font-size: 20px; font-weight: 600;">What guarantees are that we won't fool you?</span>
<span style="font-size: 14px; margin-top: 8px;">We are not a politically motivated group and we want nothing more than money.</span>
<span style="font-size: 14px; margin-top: 8px;">If you pay, we will provide you with decryption software and destroy the stolen data.</span>
<span style="font-size: 14px; margin-top: 8px;">After you pay the ransom, you will quickly restore your systems and make even more money.</span>
<span style="font-size: 14px; margin-top: 8px;">Treat this situation simply as a paid training for your system administrators, because it is due to your corporate network not being properly configured that we were able to attack you.</span>
<span style="font-size: 14px; margin-top: 8px;">Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and pay for it.</span>
<span style="font-size: 14px; margin-top: 8px;">If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future.</span>
<span style="font-size: 14px; margin-top: 8px;">You can get more information about us on Twitter https://twitter.com/hashtag/incransom?f=live</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">Warning! Don't delete or modify encrypted files, it will lead to problems with decryption of files!</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">Don't go to the police or the FBI for help. They won't help you.</span>
<span style="font-size: 14px; margin-top: 8px;">The police will try to prohibit you from paying the ransom in any way.</span>
<span style="font-size: 14px; margin-top: 8px;">The first thing they will tell you is that there's no guarantee to decrypt your files and remove stolen files.</span>
<span style="font-size: 14px; margin-top: 8px;">This is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it's a matter of our reputation.</span>
<span style="font-size: 14px; margin-top: 8px;">Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees.</span>
<span style="font-size: 14px; margin-top: 8px;">The police and the FBI don't care what losses you suffer as a result of our attack, and we'll help you get rid of all your problems for a modest sum of money.</span>
<span style="font-size: 14px; margin-top: 8px;">If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom.</span>
<span style="font-size: 14px; margin-top: 8px;">The police and FBI won't be able to stop lawsuits from your customers for leaking personal and private information.</span>
<span style="font-size: 14px; margin-top: 8px;">The police and FBI won't protect you from repeated attacks.</span>
</div>
<div style="display: flex; flex-direction: column; margin-top: 16px;">
<span style="font-size: 20px; font-weight: 600;">If you do not pay the ransom, we will attack your company again in the future.</span>
</div>
</div>
</div>
</body>
</html>
URLs
https://twitter.com/hashtag/incransom?f=live</span>
Signatures
-
INC Ransomware
INC Ransom is a ransomware that emerged in July 2023.
-
Inc_ransom family
-
Renames multiple (303) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 3 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-29_8a275265a27f6426cc9f1ea0b0e24bcf_inc_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-29_8a275265a27f6426cc9f1ea0b0e24bcf_inc_luca-stealer.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{FE018685-6517-45A6-86D3-9B2791250C57}.xps" 1338262047006700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5bdd7a7b257a69198ecaf9fc5aca78460
SHA14b8ee842973446c2cd288bcc45caa6846eaa27fd
SHA256da0da2f95e789a0d49ec9ac075f353beb71825bbf490a146f70e3279f964be8b
SHA512a1a937910270d054046304f947f5d51b3152873aff40a37fd45d8fbb78928673049d2001facbd937668ab1ec8ea61b4222d88ffd694e7c9d98309d56dd7bd86c
-
Filesize
3KB
MD51ee02b7dfa0f1516c4218569ad55e6c0
SHA14b8358b9073b87cbcfd7cd820486ecc8da45b434
SHA256d531c9e92db5cd4a3cc2fc7a6e5fdd959cbfcf3608e32a3b3e35c3c1cfa421a5
SHA512dfe89333181631fc1a11dd85421206ff95d65df876b6a9d3343d2a590d8c1ef3a5995e98a42f0748bb109c9268273bdb9729cebfe2f5ba1cd102ddafb3a164a9
-
Filesize
64KB
MD5fcd6bcb56c1689fcef28b57c22475bad
SHA11adc95bebe9eea8c112d40cd04ab7a8d75c4f961
SHA256de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31
SHA51273e4153936dab198397b74ee9efc26093dda721eaab2f8d92786891153b45b04265a161b169c988edb0db2c53124607b6eaaa816559c5ce54f3dbc9fa6a7a4b2
-
Filesize
4KB
MD5f6884cdc2899862f0090dde15d2e79bf
SHA18e136fb929efa7971b5eb3d0a5ceb1f994a7340d
SHA25688fd1a5b6f7bbc8212929af2b33efe0688d22f25ca85203957b3c2f235febbda
SHA51261434763cb0c8a0c03e9d14d13cc6a1a3eb2f1f66390fe3150efeaade2aac3f7c853be19121fefbf3297a2bb2b95e4475acab47a056170a887ba230134d4ba2f
-
Filesize
4KB
MD5d446ae7e658f7ab4e39997bb1133512e
SHA1d3062f18b3e1da4e79ac1a30d5971d1aab716a4f
SHA2567a047265116b920ee279e0b8b48e61e4c9a462273bcb8838a58bbec7a73326f7
SHA512b244d7aeaf4e6a715805a17a07adfd6121da5a81e8f8277beb42fddafb39149ef7a19dfb40478f101355b908059e4540c6d4530bc8e2c367c717b0646929014a
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB