049335b513b76cd807e3587f8f2089a4e07fca7d41404cb89f95da348c82be68

General

Target
luckyware fuckr 2.1.exe
Size 559KB
Sample260804-xdf9bsfc67
SHA256 049335b513b76cd807e3587f8f2089a4e07fca7d41404cb89f95da348c82be68
MD5 94304228b991ad4e1b04f31d380a1ad5
SHA1 e167021463671e80038b1401fa454e9773153a05
SHA512 db796a4c9d59702f5d89824aed4314dda2dcc8c071c1ac92c07436efdecba0d9074548a04cacb1e2ab0a4b7abe4888ba09e00a17a7ba49ac4d6f56ea40f21279
SSDEEP 6144:NATZN84Aw1zs+NsSrSgZrWs+H0rRahO2qbUqev/nkCuIf68KOEUyV1f6TKKXE4Uy:NYDB1zNzrpw0QybE/knIfgOrW1CTKkP
TLSH
T138C46D36A79402FCE1ABD179CE424D06E772784917B09ADF17E046A21F276E05F3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	luckyware fuckr 2.1.exe

Modifies Windows Firewall 2 TTPs 6 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3452	netsh.exe
3288	netsh.exe
2216	netsh.exe
5388	netsh.exe
4428	netsh.exe
2392	netsh.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4868	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	luckyware fuckr 2.1.exe
4716	luckyware fuckr 2.1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3452	4716	luckyware fuckr 2.1.exe	90
PID 4716 wrote to memory of 3288	4716	luckyware fuckr 2.1.exe	92
PID 4716 wrote to memory of 2216	4716	luckyware fuckr 2.1.exe	94
PID 4716 wrote to memory of 5388	4716	luckyware fuckr 2.1.exe	96
PID 4716 wrote to memory of 4428	4716	luckyware fuckr 2.1.exe	98
PID 4716 wrote to memory of 2392	4716	luckyware fuckr 2.1.exe	100
PID 4716 wrote to memory of 4868	4716	luckyware fuckr 2.1.exe	102
PID 4716 wrote to memory of 256	4716	luckyware fuckr 2.1.exe	104

C:\Users\Admin\AppData\Local\Temp\luckyware fuckr 2.1.exe
"C:\Users\Admin\AppData\Local\Temp\luckyware fuckr 2.1.exe"
1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall show rule name="LUCKYWARE_BLOCK_91.92.243.218"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3452
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="LUCKYWARE_BLOCK_91.92.243.218_OUT" dir=out action=block remoteip=91.92.243.218
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3288
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="LUCKYWARE_BLOCK_91.92.243.218_IN" dir=in action=block remoteip=91.92.243.218
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2216
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall show rule name="LUCKYWARE_BLOCK_188.114.96.11"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5388
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="LUCKYWARE_BLOCK_188.114.96.11_OUT" dir=out action=block remoteip=188.114.96.11
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4428
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="LUCKYWARE_BLOCK_188.114.96.11_IN" dir=in action=block remoteip=188.114.96.11
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2392
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:4868
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /query /fo CSV /v > "C:\Users\Admin\AppData\Local\Temp\luckaware_tasks.txt" 2>nul
  2⤵
  PID:256