Overview

overview

10

Static

static

1

ee496f1606...23.exe

windows7-x64

10

ee496f1606...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-02-2023 09:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee496f1606f4f5efe8f45af252634f836502a05fb2d26950da0cbf53faebda23.exe

  • Size

    159KB

  • MD5

    b29ad70c7126ec04cabfbd250eb6773d

  • SHA1

    b478853d86fe81a499f7b3e25b693e2eb3c1d28f

  • SHA256

    ee496f1606f4f5efe8f45af252634f836502a05fb2d26950da0cbf53faebda23

  • SHA512

    e772cbe6ec92648f69609beed99bd47af2d0aab5ef1c5817944cbdcd2951ff4e97b6639e9f653b405cf5d5b8249c3cc9ce4101ae2ae186d49abc416e80375c80

  • SSDEEP

    3072:Uk4sWR8jfowtrMuayS8h1556XhNWVub5vokomPb2eJSp8Bb8EG:QsWRWfDtrE2whpfPqC8EG

Score
10/10
marsstealerdefaultstealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

188.127.227.72/gate.php

Signatures

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee496f1606f4f5efe8f45af252634f836502a05fb2d26950da0cbf53faebda23.exe
    "C:\Users\Admin\AppData\Local\Temp\ee496f1606f4f5efe8f45af252634f836502a05fb2d26950da0cbf53faebda23.exe"
    1⤵
      PID:5060

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/5060-132-0x0000000000400000-0x000000000043D000-memory.dmp
      Filesize

      244KB

      Download
    • memory/5060-133-0x0000000000400000-0x000000000043D000-memory.dmp
      Filesize

      244KB

      Download