Analysis
-
max time kernel
91s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 22:55
Static task
static1
Behavioral task
behavioral1
Sample
utweb_installer.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
utweb_installer.exe
Resource
win10v2004-20231215-en
General
-
Target
utweb_installer.exe
-
Size
12.4MB
-
MD5
aa6ba9e8041dcef9d5b1dbaa1fb41570
-
SHA1
8244de9d8b89058d1c03f0d5a42e276227574159
-
SHA256
e482863957a81bf585e637311d51be7a4cb8819d432ce5dab3b089ceb46005b5
-
SHA512
24fabd8186b2b327b057a19f86c4e74bd57e0e807eb01a7b727d27a610e8e8ceeeb2827fe32b722e7f1a468a02535f026f00e484ff40c38c724db9e1e480b2a6
-
SSDEEP
3072:3qhbDcxipV57ihAgGHQhOxg4GUHmEOW2zOyQ5OGXubV0EYH9QJSp8Bb8EGq:SncxipAASq1mv/S5DXubV0EYk8EG
Malware Config
Extracted
marsstealer
Default
moscow-post.ru/blog/wp-content/rss.php
Signatures
-
Mars Stealer
An infostealer written in C++ based on other infostealers.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3080 3292 WerFault.exe utweb_installer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe"C:\Users\Admin\AppData\Local\Temp\utweb_installer.exe"1⤵PID:3292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 13802⤵
- Program crash
PID:3080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3292 -ip 32921⤵PID:1680