marsstealer | f7088b41145a03315b31915a42591bb1a7d31f7972c250bcc5f8027a5f17c1ff

Analysis

max time kernel
217s
max time network
248s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe
Size 8.9MB
Sample231013-evwfgafe97
SHA256 5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03
MD5 568ffcfaa64ab5839567cd712dc89f3f
SHA1 54c20e8c4cd9ea9bbc2ad0556a123ec83538010e
SHA512 67bb3c27665260ff81da99dea35b973c6d497809d8680a15e3e7cf28f4e92e56438c6a60165a11a4a574468cc4fe8a8c14e55f97b3d669285cbddadd81ac9aa1
SSDEEP 49152:Gdy+JISTQVusqLcj+Tc9X32FG4IQ8316uEtncZsdVby8kikrduPT803A7/01XB09:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

www.criminalaffair.com/07516e72fc86fad83aead3ae7.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe

Executes dropped EXE 3 IoCs

pid	Process
2756	9HINV5MT.exe
1620	67PDIYLH.exe
4432	9HINV5MT.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2756	2000	5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe	84
PID 2000 wrote to memory of 2756	2000	5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe	84
PID 2000 wrote to memory of 2756	2000	5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe	84
PID 2000 wrote to memory of 1620	2000	5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe	85
PID 2000 wrote to memory of 1620	2000	5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe	85
PID 2000 wrote to memory of 1620	2000	5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe	85
PID 2756 wrote to memory of 4432	2756	9HINV5MT.exe	86
PID 2756 wrote to memory of 4432	2756	9HINV5MT.exe	86
PID 2756 wrote to memory of 4432	2756	9HINV5MT.exe	86

C:\Users\Admin\AppData\Local\Temp\5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe
"C:\Users\Admin\AppData\Local\Temp\5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2000
- C:\ProgramData\WindowsHolographicDevices\9HINV5MT.exe
  "C:\ProgramData\WindowsHolographicDevices\9HINV5MT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\is-9KI51.tmp\9HINV5MT.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-9KI51.tmp\9HINV5MT.tmp" /SL5="$D004E,3034260,56832,C:\ProgramData\WindowsHolographicDevices\9HINV5MT.exe"
    3⤵
    - Executes dropped EXE
    PID:4432
- C:\ProgramData\WindowsHolographicDevices\67PDIYLH.exe
  "C:\ProgramData\WindowsHolographicDevices\67PDIYLH.exe"
  2⤵
  - Executes dropped EXE
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

67PDIYLH.exe

Path C:\ProgramData\WindowsHolographicDevices\67PDIYLH.exe
Size 159KB
SHA256 32ef804c9ddf6f5a97291fc0a78efcc04849f5eb8aaf4d48fc3b04b419a148ed
MD5 a6d5b3988d10b2c887490b620a1cd96f
SHA1 e85752fef9b2d44bb2107608b66a8842f6122651
SHA512 ccde8a9793da255644c8cf04c2a4b5dbcc52ceaae137218d9b8fa508d52777000aa7388c9994e622fdfdc8e689ea894820a7a2ea6f4be1fb414f3ef6f6cbd48a
SSDEEP 3072:UF3AKQzQjr+a9rhN3OLdx+2yxXaHLfBsMCOLC3JSp8Bb8EG:fKQzQ2aZeBX0aHlsMCOej8EG
MD5 SHA1 SHA512 SSDEEP

Submit Download

67PDIYLH.exe

Path C:\ProgramData\WindowsHolographicDevices\67PDIYLH.exe
Size 159KB
SHA256 32ef804c9ddf6f5a97291fc0a78efcc04849f5eb8aaf4d48fc3b04b419a148ed
MD5 a6d5b3988d10b2c887490b620a1cd96f
SHA1 e85752fef9b2d44bb2107608b66a8842f6122651
SHA512 ccde8a9793da255644c8cf04c2a4b5dbcc52ceaae137218d9b8fa508d52777000aa7388c9994e622fdfdc8e689ea894820a7a2ea6f4be1fb414f3ef6f6cbd48a
SSDEEP 3072:UF3AKQzQjr+a9rhN3OLdx+2yxXaHLfBsMCOLC3JSp8Bb8EG:fKQzQ2aZeBX0aHlsMCOej8EG
MD5 SHA1 SHA512 SSDEEP

Submit Download

67PDIYLH.exe

Path C:\ProgramData\WindowsHolographicDevices\67PDIYLH.exe
Size 159KB
SHA256 32ef804c9ddf6f5a97291fc0a78efcc04849f5eb8aaf4d48fc3b04b419a148ed
MD5 a6d5b3988d10b2c887490b620a1cd96f
SHA1 e85752fef9b2d44bb2107608b66a8842f6122651
SHA512 ccde8a9793da255644c8cf04c2a4b5dbcc52ceaae137218d9b8fa508d52777000aa7388c9994e622fdfdc8e689ea894820a7a2ea6f4be1fb414f3ef6f6cbd48a
SSDEEP 3072:UF3AKQzQjr+a9rhN3OLdx+2yxXaHLfBsMCOLC3JSp8Bb8EG:fKQzQ2aZeBX0aHlsMCOej8EG
MD5 SHA1 SHA512 SSDEEP

Submit Download

9HINV5MT.exe

Path C:\ProgramData\WindowsHolographicDevices\9HINV5MT.exe
Size 3.2MB
SHA256 b8cab489c46b5a6bb978b90c3ef06cc0c454f53d5cde773734dcdce9514b79a1
MD5 604fdaf426407abe31f9afdd0028059f
SHA1 fc5ba5fce060f5d987bcc234d7705826fd01a51e
SHA512 9a98b2cfe7e571b18ef6bccee17c9c7592aaa24e0f239512093994998cf492d2c08adc04e4ae5edaecf52fe838cb653dee35fd364410009b74be324c971da3b5
SSDEEP 98304:t1IDSUg7oYJJI1PFXUYVnowe6NE7dBKgFInJ2gO:/IDI7oYz8FXFNG6ijrFIn4
MD5 SHA1 SHA512 SSDEEP

Submit Download

9HINV5MT.exe

Path C:\ProgramData\WindowsHolographicDevices\9HINV5MT.exe
Size 3.2MB
SHA256 b8cab489c46b5a6bb978b90c3ef06cc0c454f53d5cde773734dcdce9514b79a1
MD5 604fdaf426407abe31f9afdd0028059f
SHA1 fc5ba5fce060f5d987bcc234d7705826fd01a51e
SHA512 9a98b2cfe7e571b18ef6bccee17c9c7592aaa24e0f239512093994998cf492d2c08adc04e4ae5edaecf52fe838cb653dee35fd364410009b74be324c971da3b5
SSDEEP 98304:t1IDSUg7oYJJI1PFXUYVnowe6NE7dBKgFInJ2gO:/IDI7oYz8FXFNG6ijrFIn4
MD5 SHA1 SHA512 SSDEEP

Submit Download

9HINV5MT.exe

Path C:\ProgramData\WindowsHolographicDevices\9HINV5MT.exe
Size 3.2MB
SHA256 b8cab489c46b5a6bb978b90c3ef06cc0c454f53d5cde773734dcdce9514b79a1
MD5 604fdaf426407abe31f9afdd0028059f
SHA1 fc5ba5fce060f5d987bcc234d7705826fd01a51e
SHA512 9a98b2cfe7e571b18ef6bccee17c9c7592aaa24e0f239512093994998cf492d2c08adc04e4ae5edaecf52fe838cb653dee35fd364410009b74be324c971da3b5
SSDEEP 98304:t1IDSUg7oYJJI1PFXUYVnowe6NE7dBKgFInJ2gO:/IDI7oYz8FXFNG6ijrFIn4
MD5 SHA1 SHA512 SSDEEP

Submit Download

9HINV5MT.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-9KI51.tmp\9HINV5MT.tmp
Size 694KB
SHA256 1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
MD5 ffcf263a020aa7794015af0edee5df0b
SHA1 bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA512 49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
SSDEEP 12288:bQhCh1/aLmSKrPD37zzH2A6QGgx/bsQYq9KgERkVfzrrNVyblD4cNaf/yxyR:bQYh1yLmSKrPD37zzH2A6QD/IpqggE29
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1620-21-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1620-52-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/2000-1-0x00007FFBE4C20000-0x00007FFBE56E1000-memory.dmp

Download

memory/2000-20-0x00007FFBE4C20000-0x00007FFBE56E1000-memory.dmp

Download

memory/2000-0-0x00000000002B0000-0x0000000000B94000-memory.dmp

Download

memory/2000-40-0x00007FFBE4C20000-0x00007FFBE56E1000-memory.dmp

Download

memory/2756-26-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2756-37-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2756-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2756-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4432-32-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/4432-38-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4432-44-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4432-46-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/4432-50-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads