marsstealer | ec4f9699f50903d03e0e41c9556fc580ac28f1d0d774804afcd8c8b5a63ef200

General

Target

SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe
Size

73KB
MD5

6a9f8be3c2b2884fafdec436306fc007
SHA1

4793ebd93446a6586b6e849d7d549cf19d0b00b0
SHA256

ec4f9699f50903d03e0e41c9556fc580ac28f1d0d774804afcd8c8b5a63ef200
SHA512

97e4f77b53aea02d9799539e9c10867621f1739655b1b325709b503e78979b3e4d8a19875212151764d413ff8ee40e83af725b5da99e18f4db16b5e925fc7462
SSDEEP

384:ErOLR6gC49on16IfffffffffffffffffffffffffHRv8B/6apUEmvAv8rj3tZB6I:ErKRNrivZ

Score

10^/10

marsstealer default persistence spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

152.89.218.174/gate.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe

Loads dropped DLL 2 IoCs

pid	Process
876	RegAsm.exe
876	RegAsm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Smvnyham = "\"C:\\Users\\Admin\\AppData\\Roaming\\Amdxggzmcno\\Smvnyham.exe\""	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4036	876	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2568	powershell.exe
2568	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe
Token: SeDebugPrivilege	2568	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 2568	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	86
PID 4756 wrote to memory of 2568	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	86
PID 4756 wrote to memory of 2568	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	86
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92
PID 4756 wrote to memory of 876	4756	SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe	92

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.58176.18184.30627.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  - Loads dropped DLL
  PID:876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 1392
    3⤵
    - Program crash
    PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 876 -ip 876
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\nss3.dll

Filesize
1.2MB

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
memory/876-172-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/876-151-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/876-150-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/876-149-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/876-147-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2568-142-0x0000000006290000-0x00000000062F6000-memory.dmp

Filesize
408KB

Download
memory/2568-139-0x0000000005370000-0x00000000053A6000-memory.dmp

Filesize
216KB

Download
memory/2568-143-0x00000000068F0000-0x000000000690E000-memory.dmp

Filesize
120KB

Download
memory/2568-144-0x0000000007F50000-0x00000000085CA000-memory.dmp

Filesize
6.5MB

Download
memory/2568-145-0x0000000006DE0000-0x0000000006DFA000-memory.dmp

Filesize
104KB

Download
memory/2568-140-0x00000000059E0000-0x0000000006008000-memory.dmp

Filesize
6.2MB

Download
memory/2568-141-0x0000000006170000-0x00000000061D6000-memory.dmp

Filesize
408KB

Download
memory/4756-132-0x00000000002C0000-0x00000000002D8000-memory.dmp

Filesize
96KB

Download
memory/4756-137-0x0000000005C00000-0x0000000005C22000-memory.dmp

Filesize
136KB

Download
memory/4756-136-0x0000000005A80000-0x0000000005B12000-memory.dmp

Filesize
584KB

Download
memory/4756-135-0x0000000005F90000-0x0000000006534000-memory.dmp

Filesize
5.6MB

Download
memory/4756-134-0x0000000005920000-0x00000000059D2000-memory.dmp

Filesize
712KB

Download
memory/4756-133-0x0000000005810000-0x0000000005860000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing