Analysis

  • max time kernel
    93s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2023 02:19

General

  • Target

    Ghost Hunter Vena_d-34UG1.exe

  • Size

    10.5MB

  • MD5

    7c3cdfd4ec2ef7074aa6cba65aedec95

  • SHA1

    b248fdaf6f4bdcb0c470059065069c931c9b6362

  • SHA256

    6dea57ecfe1a092b1c434f571276426140f18b514b79128f8daee7d61cd85c63

  • SHA512

    c40ba8d6663ea6a3e9125d8bcdb2cae8fc34cfc9d6b70746769d7c0921176f21a881f85a91f6f6280f7ddacd654d7ae394de01718a8210968ed8cafe2f82de52

  • SSDEEP

    12288:fuI/t26BoC4OIrOdSj5KFbkj2jUUDJLLUp+ezD3iH:TuOdSf2IKRU

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

moscow-post.ru/blogggg/blogger.php

Signatures

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ghost Hunter Vena_d-34UG1.exe
    "C:\Users\Admin\AppData\Local\Temp\Ghost Hunter Vena_d-34UG1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A6XFCDNE2.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A6XFCDNE2.exe"
      2⤵
      • Executes dropped EXE
      PID:3616
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 1404
        3⤵
        • Program crash
        PID:936
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3616 -ip 3616
    1⤵
      PID:1648

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A6XFCDNE2.exe

      Filesize

      86KB

      MD5

      061647d33aba9b76568b724b75e51fa6

      SHA1

      42fb62744aa41e2e3c78f6ad9ee690b71c9a019b

      SHA256

      6891320b9cf5dbf1278eb5c262a19a977d199666560dab26f920967e3f387474

      SHA512

      a606acce217895032688cc2cd88b6cbad5b80fca300b6d29c4f827b49de8732feeeba67678867f3837ca4002870fb20f849619418f2943668b3231e7f1af1628

    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A6XFCDNE2.exe

      Filesize

      97KB

      MD5

      5573cff5bae94857755ff999d5a1fc4d

      SHA1

      6dbc943031be6f417740923b9eff0d3c849b9c33

      SHA256

      dca3d3887c3db7ff5c182a6b50ef126f91c3ca0abdd230a828d7e9cbaf2d418f

      SHA512

      e0ccaa55a00ab094065184d8fd23a63a2459fdf3c48a67b727afa33e62a2bb144ad3538d42874aa91c46cd72c6af5a472ea897b105412bc9c343d75cb3cb9e9c

    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A6XFCDNE2.exe

      Filesize

      138KB

      MD5

      ef1851b2ae7fc3b4ab80a821315e4dee

      SHA1

      a8ff1018247ba559321c66911b58570cfce96d0d

      SHA256

      7b2e308b97113a2d055a9fceade992868348ccfb8c5f7e60ec8a5c1f62d02431

      SHA512

      ee604386b52e7b9c1ebbf4a35be0d17b7d7d850e5dbc4a15d146ef3b344cb1240a3f6b154e0f8df93df3052d04c0a2f724e20a2e23174a14a24db7a7dc0bb0aa

    • memory/1664-1-0x0000000074AB0000-0x0000000075260000-memory.dmp

      Filesize

      7.7MB

    • memory/1664-0-0x0000000000DD0000-0x0000000000E42000-memory.dmp

      Filesize

      456KB

    • memory/1664-2-0x0000000005730000-0x0000000005740000-memory.dmp

      Filesize

      64KB

    • memory/1664-13-0x0000000074AB0000-0x0000000075260000-memory.dmp

      Filesize

      7.7MB

    • memory/3616-12-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3616-15-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB