lucastealer | 58a6369e06d4f4adeebb3ea78430d7b6882c5a8e7bf0909bd38f63ad311d1149

General

Target

flasher.exe
Size

1.4MB
MD5

3845ac30b6348d3df03c46ed1e7a257a
SHA1

0bb236a415612bc50d9a946812e3083f0c9a4943
SHA256

58a6369e06d4f4adeebb3ea78430d7b6882c5a8e7bf0909bd38f63ad311d1149
SHA512

51518959e2e1d19baa3482d5e29eef9023b1cd9ff661c0673b571ee93514a2d60bc73dc554d7527b2167c7b8989b16962596ee8216b73975f7093264b164a0ec
SSDEEP

24576:Dr5ub/rrvDe7hH3rK67HCU1CkPNlm2/Ubb6I+mGAhC2Kllyv/5nJ7lj9iwGsI:DVub/rrvDehrfTCbi4NXJWA4lypFl0

Score

10^/10

lucastealer credential_access execution spyware stealer upx

Malware Config

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/1684-93-0x00007FF7BC3D0000-0x00007FF7BC6F0000-memory.dmp	family_lucastealer
behavioral2/memory/1684-97-0x00007FF7BC3D0000-0x00007FF7BC6F0000-memory.dmp	family_lucastealer

Lucastealer family
lucastealer
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1684-0-0x00007FF7BC3D0000-0x00007FF7BC6F0000-memory.dmp	upx
behavioral2/memory/1684-93-0x00007FF7BC3D0000-0x00007FF7BC6F0000-memory.dmp	upx
behavioral2/memory/1684-97-0x00007FF7BC3D0000-0x00007FF7BC6F0000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4420	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4420	powershell.exe
4420	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4420	1684	flasher.exe	86
PID 1684 wrote to memory of 4420	1684	flasher.exe	86

C:\Users\Admin\AppData\Local\Temp\flasher.exe
"C:\Users\Admin\AppData\Local\Temp\flasher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:2480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IlzJFLSnUkzoDPlyPjahv1YULDEtN6\sensfiles.zip

Filesize
4.1MB

MD5
b4d1413868b8c0784936432489f54106

SHA1
6add281a4ed084be8da1df565c3975afecd61c57

SHA256
2f2bb9f13c4398401b3a90102ca0b3ef1d30d168cfbaeb349ccfca511445f5fc

SHA512
a9fcab8fce35d0dcf39b13f63c12d8c9b5662d45c8fef91ccc196d82db0b6afcc820f29df6ed88d7368d1176fd737d1b9829a700a9dba05f3861e2a01f188cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bapnyr1d.f3g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\qip surf_default_login_data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\qip surf_default_webdata

Filesize
114KB

MD5
af4d3825d4098bd9c66faf64e20acdc8

SHA1
e205b61bd6e5f4d44bc36339fe3c207e52ee2f01

SHA256
095484268f554458404ca64d5c9f7b99abe0dbb1a75e056184047dc836f2e484

SHA512
71b4b99614e28a85925033f95d90e7c43f958b2284f7d7605d2ea896330efa9bba8b6d9550f62829daec3cf452e95c964ddb30cd9c7850bfa41a988792132e78

Download Submit
C:\Users\Admin\AppData\Local\Temp\qip surf_network_cookies

Filesize
20KB

MD5
5ae4c2a03c28b2dd9dc447b8b178e230

SHA1
2d942e07707c5ad772a94eb8569d7c35130a2de9

SHA256
5d730477a3225e53b612477006a337e6837d1b0c86ad15612c664d23d1f5ffc6

SHA512
85f438bc5330f37b74afb3eb6ba576c7ac31a0578455f97feae10006f47f50329e138fcb1909bb55c9db467f1ee975c7c43efef2e110145019ba119b0312ffc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\settings_default_login_data

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
memory/1684-0-0x00007FF7BC3D0000-0x00007FF7BC6F0000-memory.dmp

Filesize
3.1MB

Download
memory/1684-93-0x00007FF7BC3D0000-0x00007FF7BC6F0000-memory.dmp

Filesize
3.1MB

Download
memory/1684-97-0x00007FF7BC3D0000-0x00007FF7BC6F0000-memory.dmp

Filesize
3.1MB

Download
memory/4420-2-0x0000020DA47F0000-0x0000020DA4812000-memory.dmp

Filesize
136KB

Download
memory/4420-12-0x00007FF809570000-0x00007FF80A031000-memory.dmp

Filesize
10.8MB

Download
memory/4420-13-0x00007FF809570000-0x00007FF80A031000-memory.dmp

Filesize
10.8MB

Download
memory/4420-17-0x00007FF809570000-0x00007FF80A031000-memory.dmp

Filesize
10.8MB

Download
memory/4420-1-0x00007FF809573000-0x00007FF809575000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing