lucille[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lucille.exe
Size 1.2MB
Sample260722-e8fbeavzcy
SHA256 a16566553e6e8f2f82dec5b255b209f46746231a79883075a754d996a0d78f0f
MD5 8df41e7b395fc0ff5251caa34c1eee6b
SHA1 618209ec200333ad779106a20e321ead0ebd1c00
SHA512 688c7d4b8545c278d929b4c21abe809ec7fab1bedaa4a6549ee6caad2cf1a5a754a7f7ca6ae81b6efa648a372b8a0399b745840c191aa5c76038033864f07b82
SSDEEP 24576:Vg8fq/an8UZCcUWZQH0CVWlpA5VxehlJqi4n5EpQJpjB:Vgsq/an8UUcvBCVWrOxehlJz4n5wQjj
TLSH
T19045BF0A71A110E8D4BAE074D692B917F671344C13709BEB27F01A499FBB7E11ABBF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lucille.exe

File Explorer

lucille.exe

.exe 1.2MB

lucille.exe

IMPHASH 97d58a79b6ff231974b7a0a84929ba39
SHA256 a16566553e6e8f2f82dec5b255b209f46746231a79883075a754d996a0d78f0f
MD5 8df41e7b395fc0ff5251caa34c1eee6b
SHA1 618209ec200333ad779106a20e321ead0ebd1c00
SHA512 688c7d4b8545c278d929b4c21abe809ec7fab1bedaa4a6549ee6caad2cf1a5a754a7f7ca6ae81b6efa648a372b8a0399b745840c191aa5c76038033864f07b82
SSDEEP 24576:Vg8fq/an8UZCcUWZQH0CVWlpA5VxehlJqi4n5EpQJpjB:Vgsq/an8UUcvBCVWrOxehlJz4n5wQjj
TLSH
T19045BF0A71A110E8D4BAE074D692B917F671344C13709BEB27F01A499FBB7E11ABBF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

881508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ferri\Downloads\roblox-ext\roblox-ext\x64\Release\lucille.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winmm

timeEndPeriod timeBeginPeriod

dwmapi

DwmExtendFrameIntoClientArea

wininet

InternetReadFile InternetCloseHandle InternetOpenUrlA InternetOpenA

kernel32

IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable VirtualFree OutputDebugStringA VirtualAlloc GetModuleHandleA CloseHandle GetProcAddress Sleep QueryPerformanceFrequency QueryPerformanceCounter GetSystemInfo VirtualQueryEx GetConsoleWindow MultiByteToWideChar LoadLibraryA FreeLibrary CreateToolhelp32Snapshot Process32NextW Process32FirstW GetModuleHandleW lstrcmpiW SetConsoleTitleA GetStdHandle SetConsoleMode GetConsoleMode SetConsoleOutputCP OpenProcess GetCurrentProcessId Module32FirstW ReadProcessMemory GetSystemTimeAsFileTime WideCharToMultiByte GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSListHead GetLastError

user32

RegisterClassExW GetClassNameA UnregisterClassW GetSystemMetrics GetWindowThreadProcessId DefWindowProcW GetWindowRect DestroyWindow IsWindowVisible CreateWindowExW ScreenToClient ClientToScreen PeekMessageW GetWindowTextA SetWindowDisplayAffinity GetForegroundWindow MoveWindow EnumWindows TranslateMessage SetWindowLongW PostQuitMessage UpdateWindow GetKeyState GetMessageExtraInfo GetCapture TrackMouseEvent LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture ShowWindow GetKeyNameTextA MapVirtualKeyA GetAsyncKeyState SendInput DispatchMessageW FindWindowA GetCursorPos

ole32

CoInitialize CoCreateInstance

msvcp140

??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException memcmp memchr strstr memmove __std_exception_destroy __std_exception_copy __std_terminate memcpy

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _beginthreadex terminate _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _errno _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv abort _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_wfopen __stdio_common_vsprintf_s fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsscanf fwrite fgetc fclose fflush __stdio_common_vsprintf fputc __p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr atan2 acos _fdclass nearbyint _dclass sqrtf cos ceilf sqrt sinf ceil fmodf atan2f roundf round sin fmod expf acosf cosf

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-convert-l1-1-0

strtof strtoll strtol strtoull strtod

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale