marsstealer | 51c164ebcff319d1691a261a74b84a83e556400fb6b1f04f094cc5da8904f21c

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2023 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446.exe
Size

11.5MB
MD5

46431992aa566007949fc4acbc058856
SHA1

533e0cef48e51095f1460fd52cc542923d23d29d
SHA256

846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446
SHA512

02b1bb111b9db1af37d7f06a36e5f59aac0e9f6a36878db0148f36b7c68ac93f0d136755a8b0a084a510adf2b9eff4cd72b2ab20849a0ea333920557808a2a52
SSDEEP

3072:3+fKfLxPq+l/AGDF+FUN9TgPC543HaHJSp8Bb8EGF9N7:OfKfI+l4GDCACS4Kz8EGF9N

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

www.msk-post.com/server/init.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2264 852 WerFault.exe 846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446.exe

pid	pid_target	process	target process
2264	852	WerFault.exe	846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446.exe

C:\Users\Admin\AppData\Local\Temp\846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446.exe
"C:\Users\Admin\AppData\Local\Temp\846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446.exe"
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 1600
2⤵
- Program crash
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 852 -ip 852
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/852-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download