marsstealer | 911221ce521f77139ecfa2a277c277aaee6bff7094d9c5b31b893a4b104dea48

Analysis

max time kernel
0s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2023 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SENSIXDPANNEL.exe
Size

433KB
MD5

40cf5b7e5c505da78a7f66d2950effbf
SHA1

abf961c5b9fae57411a195a00b4c7093d2fe0bc4
SHA256

911221ce521f77139ecfa2a277c277aaee6bff7094d9c5b31b893a4b104dea48
SHA512

08cbfc073c2d0f63a9b2711a81dd30809cb87eb2310ffd5b2a582a1e9ca0ebd5956093e83453310cba25a403aa28bf7cfcb3725a017188d48e66cccccb190bc5
SSDEEP

12288:pyVG1u73Do/eGm5uRWlgfS7BCag7MJQIGhJNsx61V0wrY4FS9:IGS6WRN+JGxS

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

www.moscow-post.com/wp-content/plugins/toocreate/tuzerfd.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2380 1816 WerFault.exe NY.exe

pid	pid_target	process	target process
2380	1816	WerFault.exe	NY.exe

C:\Users\Admin\AppData\Local\Temp\SENSIXDPANNEL.exe
"C:\Users\Admin\AppData\Local\Temp\SENSIXDPANNEL.exe"
1⤵
PID:3332

C:\Users\Admin\AppData\Roaming\Adobe\NY.exe
"C:\Users\Admin\AppData\Roaming\Adobe\NY.exe"
2⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 1368
3⤵
- Program crash
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1816 -ip 1816
1⤵
PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\NY.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\NY.exe
Filesize
5KB

MD5
c99b297ae587a31fec6551ee74ac9029

SHA1
49544a1e76e7a585c968a9637f18035c1a83c59c

SHA256
428d0a7f6f03f5fdc2ba4754cede4afad4646b06c4fd6f24dcf9ff38f188c4e8

SHA512
5b1dd0c6a65376dd0dbc2a848580c9b4c06ff52a50b9c5109e695766de7b1ff1da74a75f05b24aae4e2947c49493e4dbb92ea36b7286b8c1e954c0bda176d0cd

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\NY.exe
Filesize
30KB

MD5
9fe9ad9271d89f6893111cad105803c9

SHA1
4032d9c8d57580c6f78c389b90a78719b3257086

SHA256
c547dbfb49ff140f95c960d1bb14979f4bddaf83fd2fae8d941aebe377f2ef9e

SHA512
05aaf652625da4be1914b23f00b94998c1546b45caaa1f71ba3f504e717af34062fd6f3a5487e36511e90a9dc2077babcedf43a05a4b8ad08d12e7483f0120ad

Download Submit
memory/1816-12-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1816-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3332-1-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download
memory/3332-2-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3332-0-0x0000000000B80000-0x0000000000BF2000-memory.dmp

Filesize
456KB

Download
memory/3332-13-0x0000000074C40000-0x00000000753F0000-memory.dmp

Filesize
7.7MB

Download