marsstealer | fcec85746f0f2a92b1268830d6d0b075eb9080707358b93ba5fbd917b1a0a8ea | Triage

Analysis

max time kernel
46s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 18:59

Sharing

Report Analysis Logs

General

Target

MarsStealer8_cracked_by_LLCPPC.exe
Size

159KB
MD5

caa1ddfbbe03a5a5daeb718605daacb0
SHA1

1dc62e3529aaafb20c3ca16697deb5cf6792d83f
SHA256

fcec85746f0f2a92b1268830d6d0b075eb9080707358b93ba5fbd917b1a0a8ea
SHA512

fb805afdf01603eb5af3ee8807fcd42a04e49d3a106e945fa9ab57a68a5068bdfc19a685213d3601be228dfbfae52315953e2400be9051a283f6df0923518ce7
SSDEEP

3072:Um/E8k9ZjpIL+zNch12KbAwSaSbJSp8Bb8EG:N/E8k91zz6/t88EG

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1916 2020 WerFault.exe MarsStealer8_cracked_by_LLCPPC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

MarsStealer8_cracked_by_LLCPPC.exe

description	pid	process	target process
PID 2020 wrote to memory of 1916	2020	MarsStealer8_cracked_by_LLCPPC.exe	WerFault.exe
PID 2020 wrote to memory of 1916	2020	MarsStealer8_cracked_by_LLCPPC.exe	WerFault.exe
PID 2020 wrote to memory of 1916	2020	MarsStealer8_cracked_by_LLCPPC.exe	WerFault.exe
PID 2020 wrote to memory of 1916	2020	MarsStealer8_cracked_by_LLCPPC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MarsStealer8_cracked_by_LLCPPC.exe
"C:\Users\Admin\AppData\Local\Temp\MarsStealer8_cracked_by_LLCPPC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 508
2⤵
- Program crash
PID:1916

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-56-0x0000000000000000-mapping.dmp

Download
memory/2020-54-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2020-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download