marsstealer | fcec85746f0f2a92b1268830d6d0b075eb9080707358b93ba5fbd917b1a0a8ea | Triage

Analysis

max time kernel
69s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2023 18:59

Sharing

Report Analysis Logs

General

Target

MarsStealer8_cracked_by_LLCPPC.exe
Size

159KB
MD5

caa1ddfbbe03a5a5daeb718605daacb0
SHA1

1dc62e3529aaafb20c3ca16697deb5cf6792d83f
SHA256

fcec85746f0f2a92b1268830d6d0b075eb9080707358b93ba5fbd917b1a0a8ea
SHA512

fb805afdf01603eb5af3ee8807fcd42a04e49d3a106e945fa9ab57a68a5068bdfc19a685213d3601be228dfbfae52315953e2400be9051a283f6df0923518ce7
SSDEEP

3072:Um/E8k9ZjpIL+zNch12KbAwSaSbJSp8Bb8EG:N/E8k91zz6/t88EG

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

748 4936 WerFault.exe MarsStealer8_cracked_by_LLCPPC.exe

C:\Users\Admin\AppData\Local\Temp\MarsStealer8_cracked_by_LLCPPC.exe
"C:\Users\Admin\AppData\Local\Temp\MarsStealer8_cracked_by_LLCPPC.exe"
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1124
2⤵
- Program crash
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4936 -ip 4936
1⤵
PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4936-132-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4936-133-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download