marsstealer | 51c164ebcff319d1691a261a74b84a83e556400fb6b1f04f094cc5da8904f21c

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2023, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446.exe
Size 11.5MB
Sample231223-bt13sadhcn
SHA256 846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446
MD5 46431992aa566007949fc4acbc058856
SHA1 533e0cef48e51095f1460fd52cc542923d23d29d
SHA512 02b1bb111b9db1af37d7f06a36e5f59aac0e9f6a36878db0148f36b7c68ac93f0d136755a8b0a084a510adf2b9eff4cd72b2ab20849a0ea333920557808a2a52
SSDEEP 3072:3+fKfLxPq+l/AGDF+FUN9TgPC543HaHJSp8Bb8EGF9N7:OfKfI+l4GDCACS4Kz8EGF9N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

www.msk-post.com/server/init.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	852	WerFault.exe	90

C:\Users\Admin\AppData\Local\Temp\846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446.exe
"C:\Users\Admin\AppData\Local\Temp\846f5e52aa6b4f11a29cab1f505463938938c3c5ad8d753fe70a148200c8c446.exe"
1⤵
PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 1600
  2⤵
  - Program crash
  PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 852 -ip 852
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/852-8-0x0000000000400000-0x0000000000440000-memory.dmp