marsstealer | 8fceb104dd023177aa0e19f7d5049683a046baee7040bcea9d54da915994738e

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2023, 21:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Builded.exe
Size 159KB
Sample230907-z6csqaec33
SHA256 8fceb104dd023177aa0e19f7d5049683a046baee7040bcea9d54da915994738e
MD5 39c6cf660d9938f00ce6a44808ecd133
SHA1 460fa60cf7c3c5f0c5a9fd651e19f5e2eea241db
SHA512 5399797e71fdb0a8c5dcc86e3eccb480b7ca5cba43fd1b04cccacd16ddbcc7701c5b59aac89d443cc139dff484aaca35d804e6bbe180ef2c2d397ea616be4c83
SSDEEP 3072:U3l4p06GLRIuqj7oQKq0h0fXlt25K5fRZ49Tu3/CdPEcK/WJSp8Bb8EG:VIts7oQKq0h0f1tikRmQ3/cPEcKy8EG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

dispatchweekly.com/b2ecfe73736f99f5.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9A728621-FFF6-4954-8C7A-8A53F367297B}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3336

C:\Users\Admin\AppData\Local\Temp\Builded.exe
"C:\Users\Admin\AppData\Local\Temp\Builded.exe"
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5000-0-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/5000-8-0x0000000000400000-0x000000000043D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads