lucastealer | 94e3972742bf6477c34a0f073d6f4885cf8b58742f16aa8308ebffdf8b25763b

General

Target

Cryptor.exe
Size

1.4MB
MD5

a49364c7ec161533cb4edc7bca0e51c9
SHA1

584f3ef12eae032921ed7d3b9e227996197f1263
SHA256

94e3972742bf6477c34a0f073d6f4885cf8b58742f16aa8308ebffdf8b25763b
SHA512

ac0e8ece98199cd9f776aaa57c508e4bc8baf8286b86f852ab23f305dbcb4e73c7199aaf7a8b24578aecb652c415fe649212fe6666b04a23d298768f48bb013c
SSDEEP

24576:QO3hSzPPakWNlJYcDHO3aDfQ1FTA3zoET2SXqQDGaMeZK+UvB2PRriFLFQo:EWkoYcDuqDIHqT2SVyadU8PRrGLKo

Score

10^/10

lucastealer credential_access execution spyware stealer upx

Malware Config

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/820-139-0x00007FF6651E0000-0x00007FF6654FC000-memory.dmp	family_lucastealer

Lucastealer family
lucastealer
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/820-0-0x00007FF6651E0000-0x00007FF6654FC000-memory.dmp	upx
behavioral1/memory/820-139-0x00007FF6651E0000-0x00007FF6654FC000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4452	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4452	powershell.exe
4452	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4452	820	Cryptor.exe	87
PID 820 wrote to memory of 4452	820	Cryptor.exe	87

C:\Users\Admin\AppData\Local\Temp\Cryptor.exe
"C:\Users\Admin\AppData\Local\Temp\Cryptor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3Xt8iaICh1rD2gD9KC87vDeTZZY7mn\sensfiles.zip

Filesize
3.9MB

MD5
fd5c1f2cb495b7b1297fdd7b9ced4a5b

SHA1
45c1694ec5dc02f0aad993dc9e1244e7c87e93c6

SHA256
e31306b45fe7358709490e061e55ca8022b786707467671d000ca966cd81de2a

SHA512
7ff077ccfc7c104efa17580cfffaf073c3b5c11e7ff4d1f36ada69373b82d34cdd5fd696ecc16ea42b92725734abb70e3d8d3ae72432355b6fcabc15b1ea0416

Download Submit
C:\Users\Admin\AppData\Local\Temp\7star_default_login_data

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4vimmjx4.yr3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\centbrowser_default_login_data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\centbrowser_default_webdata

Filesize
114KB

MD5
b28c7f7cff15a860603a1d6523afb720

SHA1
281af1b07b39c5b75f451d2d86bfd07b42054c39

SHA256
3df169b8995f5d21eefd5f2c1edb3a15f51dcaae38c2d16d1050b3c884c71f14

SHA512
f80e505c77286abb99aa03a3f25510cf0eb092892adb2fb02add9011c85362c8d215cd1225bc73a582f4b149bdedcbb1379ae1d48d320cc535cf20710be89af3

Download Submit
C:\Users\Admin\AppData\Local\Temp\centbrowser_network_cookies

Filesize
20KB

MD5
4999bcdf2cefca409c7a5e0c3bb0ff8c

SHA1
234ae836bc14d48a7ddf14bf9e805e8fe41007f0

SHA256
2bbeb37e45487088edea498fc18a9ca66a7ea05b9347366165dc0ed49d3382be

SHA512
943cb1b046951e2bf9c5f78a70f210cf522399b68c03934a572b0652058b2ce0725c57b6ac1670a2047cd67dd42c5bc7cce10854c1aa9db00ac94a81cb2b522c

Download Submit
memory/820-0-0x00007FF6651E0000-0x00007FF6654FC000-memory.dmp

Filesize
3.1MB

Download
memory/820-139-0x00007FF6651E0000-0x00007FF6654FC000-memory.dmp

Filesize
3.1MB

Download
memory/4452-1-0x00007FF8BE803000-0x00007FF8BE805000-memory.dmp

Filesize
8KB

Download
memory/4452-2-0x00007FF8BE800000-0x00007FF8BF2C1000-memory.dmp

Filesize
10.8MB

Download
memory/4452-3-0x0000026AD3480000-0x0000026AD34A2000-memory.dmp

Filesize
136KB

Download
memory/4452-16-0x00007FF8BE800000-0x00007FF8BF2C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing