Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2023 13:44

General

  • Target

    Project.rtf

  • Size

    148KB

  • MD5

    55c518c611f0db3817822960fb83be24

  • SHA1

    a1e7a4496f0db72cc4d67fceef9bed01deff9bf0

  • SHA256

    8c18c0514255595dda708a1fe487076ed15eac9237f39f965baee9f2924003ba

  • SHA512

    43934f581fb941b23252e979465e68f42a034a4f441d0ed264b4629134c4c4245c683d980d3013f69f3801a3cc382a62cc7826ac90916234f047184b04401d4a

  • SSDEEP

    768:dwAbZSibMX9gRWjwNWgH5ufgZ1qXPH/53wYUbX6vv6ea++A30PN:dwAlR9DXZgHBzUz6vv6ea+cPN

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

alpha.twinsources.shop/gate.php

Signatures

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Project.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:268
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:856
      • C:\Users\Admin\AppData\Roaming\dukas20024.exe
        "C:\Users\Admin\AppData\Roaming\dukas20024.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Users\Admin\AppData\Roaming\dukas20024.exe
          "C:\Users\Admin\AppData\Roaming\dukas20024.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Roaming\dukas20024.exe" & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1776
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 5
              5⤵
              • Delays execution with timeout.exe
              PID:320

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      797afb21b55358538770f4474dca6864

      SHA1

      4ead4f04135c436656fb7f1841dbe96b8f95fd33

      SHA256

      ffe76852b0718d93efb1661a865f214cec1244a46cc355d1a553e200d35cfc04

      SHA512

      851fb540dd18a589a781861622bdca6372507ffeae1bc691e58376ec8a95961bd94f1eadf4bfe2dfccb3568d4c67977340299b92e1c83a1bbcd974e41f1104bb

    • C:\Users\Admin\AppData\Roaming\dukas20024.exe

      Filesize

      610KB

      MD5

      631dd8ad499c7d27b191be6f39b10685

      SHA1

      3b4660ec48c45ccf7dbc141f7c5ce95973d84362

      SHA256

      15758185066d228b103115e90ac731da6c473ee9883bc655a8fe512484b59944

      SHA512

      ad952fd9686084e3600600cb2b6dc4d3caa84b3522dc3c7401d3461b4c223f6d783e04d2cca0c38716691025e9278c6fc472d4248649d8067cc68f7a7c3364b6

    • C:\Users\Admin\AppData\Roaming\dukas20024.exe

      Filesize

      610KB

      MD5

      631dd8ad499c7d27b191be6f39b10685

      SHA1

      3b4660ec48c45ccf7dbc141f7c5ce95973d84362

      SHA256

      15758185066d228b103115e90ac731da6c473ee9883bc655a8fe512484b59944

      SHA512

      ad952fd9686084e3600600cb2b6dc4d3caa84b3522dc3c7401d3461b4c223f6d783e04d2cca0c38716691025e9278c6fc472d4248649d8067cc68f7a7c3364b6

    • C:\Users\Admin\AppData\Roaming\dukas20024.exe

      Filesize

      610KB

      MD5

      631dd8ad499c7d27b191be6f39b10685

      SHA1

      3b4660ec48c45ccf7dbc141f7c5ce95973d84362

      SHA256

      15758185066d228b103115e90ac731da6c473ee9883bc655a8fe512484b59944

      SHA512

      ad952fd9686084e3600600cb2b6dc4d3caa84b3522dc3c7401d3461b4c223f6d783e04d2cca0c38716691025e9278c6fc472d4248649d8067cc68f7a7c3364b6

    • C:\Users\Admin\AppData\Roaming\dukas20024.exe

      Filesize

      610KB

      MD5

      631dd8ad499c7d27b191be6f39b10685

      SHA1

      3b4660ec48c45ccf7dbc141f7c5ce95973d84362

      SHA256

      15758185066d228b103115e90ac731da6c473ee9883bc655a8fe512484b59944

      SHA512

      ad952fd9686084e3600600cb2b6dc4d3caa84b3522dc3c7401d3461b4c223f6d783e04d2cca0c38716691025e9278c6fc472d4248649d8067cc68f7a7c3364b6

    • \ProgramData\mozglue.dll

      Filesize

      133KB

      MD5

      8f73c08a9660691143661bf7332c3c27

      SHA1

      37fa65dd737c50fda710fdbde89e51374d0c204a

      SHA256

      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

      SHA512

      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

    • \ProgramData\nss3.dll

      Filesize

      1.2MB

      MD5

      bfac4e3c5908856ba17d41edcd455a51

      SHA1

      8eec7e888767aa9e4cca8ff246eb2aacb9170428

      SHA256

      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

      SHA512

      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

    • \Users\Admin\AppData\Roaming\dukas20024.exe

      Filesize

      610KB

      MD5

      631dd8ad499c7d27b191be6f39b10685

      SHA1

      3b4660ec48c45ccf7dbc141f7c5ce95973d84362

      SHA256

      15758185066d228b103115e90ac731da6c473ee9883bc655a8fe512484b59944

      SHA512

      ad952fd9686084e3600600cb2b6dc4d3caa84b3522dc3c7401d3461b4c223f6d783e04d2cca0c38716691025e9278c6fc472d4248649d8067cc68f7a7c3364b6

    • memory/1988-110-0x000000007171D000-0x0000000071728000-memory.dmp

      Filesize

      44KB

    • memory/1988-0-0x000000002F6F1000-0x000000002F6F2000-memory.dmp

      Filesize

      4KB

    • memory/1988-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1988-23-0x000000007171D000-0x0000000071728000-memory.dmp

      Filesize

      44KB

    • memory/1988-2-0x000000007171D000-0x0000000071728000-memory.dmp

      Filesize

      44KB

    • memory/1988-109-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2820-16-0x000000006BA70000-0x000000006C15E000-memory.dmp

      Filesize

      6.9MB

    • memory/2820-17-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

      Filesize

      256KB

    • memory/2820-26-0x0000000004FC0000-0x0000000005028000-memory.dmp

      Filesize

      416KB

    • memory/2820-25-0x00000000005E0000-0x00000000005EA000-memory.dmp

      Filesize

      40KB

    • memory/2820-15-0x0000000000120000-0x00000000001BE000-memory.dmp

      Filesize

      632KB

    • memory/2820-24-0x00000000005D0000-0x00000000005D8000-memory.dmp

      Filesize

      32KB

    • memory/2820-22-0x00000000005B0000-0x00000000005C2000-memory.dmp

      Filesize

      72KB

    • memory/2820-40-0x000000006BA70000-0x000000006C15E000-memory.dmp

      Filesize

      6.9MB

    • memory/3008-28-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/3008-38-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-39-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-35-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-42-0x0000000060900000-0x0000000060992000-memory.dmp

      Filesize

      584KB

    • memory/3008-32-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-31-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-88-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-29-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-30-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-27-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB