marsstealer | 911221ce521f77139ecfa2a277c277aaee6bff7094d9c5b31b893a4b104dea48

Analysis

max time kernel
1s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2023 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SENSIXDPANNEL.exe
Size

433KB
MD5

40cf5b7e5c505da78a7f66d2950effbf
SHA1

abf961c5b9fae57411a195a00b4c7093d2fe0bc4
SHA256

911221ce521f77139ecfa2a277c277aaee6bff7094d9c5b31b893a4b104dea48
SHA512

08cbfc073c2d0f63a9b2711a81dd30809cb87eb2310ffd5b2a582a1e9ca0ebd5956093e83453310cba25a403aa28bf7cfcb3725a017188d48e66cccccb190bc5
SSDEEP

12288:pyVG1u73Do/eGm5uRWlgfS7BCag7MJQIGhJNsx61V0wrY4FS9:IGS6WRN+JGxS

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

www.moscow-post.com/wp-content/plugins/toocreate/tuzerfd.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

232 4844 WerFault.exe L.exe

pid	pid_target	process	target process
232	4844	WerFault.exe	L.exe

C:\Users\Admin\AppData\Local\Temp\SENSIXDPANNEL.exe
"C:\Users\Admin\AppData\Local\Temp\SENSIXDPANNEL.exe"
1⤵
PID:2116

C:\Users\Admin\AppData\Roaming\Adobe\L.exe
"C:\Users\Admin\AppData\Roaming\Adobe\L.exe"
2⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1368
3⤵
- Program crash
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4844 -ip 4844
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\L.exe
Filesize
36KB

MD5
3b3d7a4500761ca84d9d060c3b77437d

SHA1
74d7fba2cfdbe34191c2fe1aa36b7ed3995279cc

SHA256
bd4650300f929ea8c6442c3574a6629bc86a3edb1a39778559328894bca2be34

SHA512
16f8a79214c167aa063e081083843d5af0c71281fd1b047e87e061d1b864f919c0b51c65b165f6f293eb0839023f7befee3413143c84d82f433efe145350dfae

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\L.exe
Filesize
100KB

MD5
779bc23c1e13c1b409d464bb986720a0

SHA1
c8e81a0fdaca96a8566ff9ea2614d42ccc701b07

SHA256
4c0e6994cedf121de14548a4bebb88434d1409dfff4264dbfc0712653f742a95

SHA512
bb5e5c3c46d72156b8f57acfbcfa76da0bac70a9f135811698c2694358a30a5a90d11226fec96c0d869523346c1a9167054b3b94d39b08bda6e0045abb0bfbff

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\L.exe
Filesize
30KB

MD5
c5d74382ca1e73f71acb2a84b5c8e57d

SHA1
21d83e38b948c9e172fb2c46df2837f1885053b9

SHA256
7dbe7ad3e376025592e7e3c1bfe032c0c2e8ef9cc5012e3dc571ad3fd525e06c

SHA512
5d6497d93d719d753f17cb7e0b26216dcea90270d01b314324374a5302d06c483f04541316cec0d9305b03a5fd3e0048ea7d4dcb3478dfec51baf1cf3273a437

Download Submit
memory/2116-1-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/2116-2-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/2116-0-0x0000000000170000-0x00000000001E2000-memory.dmp

Filesize
456KB

Download
memory/2116-13-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4844-12-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4844-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download