Overview

overview

10

Static

static

10

1ac7892dbd...2f.exe

windows7_x64

7

1ac7892dbd...2f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.bin

  • Size

    93KB

  • Sample

    220204-rbkabaahbk

  • MD5

    68958ce8e51a4b8dd6ff8b8a57515be2

  • SHA1

    d88289eab220b4d8e3dbe4f9f2ce3539105d3c4a

  • SHA256

    1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f

  • SHA512

    a3b858721fb2060bf413edf4a893a8d6e860857225bad60d7c3a5be57f672f63d71582d30ace1ed881c57ef6d47a2f196c2b2c135cb4ce86d4015332585484b4

Score
10/10
arkeimarsstealerpersistencespywarestealer

Malware Config

Extracted

Family

marsstealer

C2

http://195124.prohoster.biz/pool.php

Targets

    • Target

      1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f.bin

    • Size

      93KB

    • MD5

      68958ce8e51a4b8dd6ff8b8a57515be2

    • SHA1

      d88289eab220b4d8e3dbe4f9f2ce3539105d3c4a

    • SHA256

      1ac7892dbd3997937aced8b8856dd35cfbad407b833da3038cb025dec9a53c2f

    • SHA512

      a3b858721fb2060bf413edf4a893a8d6e860857225bad60d7c3a5be57f672f63d71582d30ace1ed881c57ef6d47a2f196c2b2c135cb4ce86d4015332585484b4

    Score
    10/10
    spywarestealerpersistence

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Sets service image path in registry

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks