marsstealer | b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UndertaleTrainer.exe
Size

3.8MB
MD5

8669e8f71fd06872bbc1d2399c33d7b1
SHA1

6cdcbc65e5b4d30c3e2e9e3e2c7ad4ed8373bcc5
SHA256

b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43
SHA512

b353fb22d846994f6c09258cccf63f92ae9db14e4dc5965bc67c7c539bdc8f51e599c7bb70a6668d8d6aeacb1551e333ae70630e1ac58f21c49032052dffa847
SSDEEP

12288:zNS9x1JXkDAoqsTAoFhb6lRZu4W1K8waHyu2Um4ytvqMNVw2LW86B7SiU:zeAzW4f

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

www.msk-post.com/server/init.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UndertaleTrainer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	UndertaleTrainer.exe

Executes dropped EXE 1 IoCs

Processes:

.exe

pid process

4552 .exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2308 4552 WerFault.exe .exe

pid	process
4552	.exe

pid	pid_target	process	target process
2308	4552	WerFault.exe	.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

UndertaleTrainer.exe

description	pid	process	target process
PID 4656 wrote to memory of 4552	4656	UndertaleTrainer.exe	.exe
PID 4656 wrote to memory of 4552	4656	UndertaleTrainer.exe	.exe
PID 4656 wrote to memory of 4552	4656	UndertaleTrainer.exe	.exe

C:\Users\Admin\AppData\Local\Temp\UndertaleTrainer.exe
"C:\Users\Admin\AppData\Local\Temp\UndertaleTrainer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4656

C:\Users\Admin\AppData\Roaming\Adobe\.exe
"C:\Users\Admin\AppData\Roaming\Adobe\.exe"
2⤵
- Executes dropped EXE
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1840
3⤵
- Program crash
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4552 -ip 4552
1⤵
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\.exe
Filesize
159KB

MD5
b13a4bddff058d6c9c44d62ecf492563

SHA1
dcf173cf7a9ae1c9b28c92a13bca0b619dee3511

SHA256
ff90f644a5d0af130cf8d61d0908447a8953d3be58c0ecd8b23f03534df30e4c

SHA512
7c8611fd762dbd1b77788dc0950323adf751a1a881b855c8b8cf132f4b3515479c56789b1360a028d5704426f37fb4610effb79824c0bc0ea85f2a3d7c638a90

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\.exe
Filesize
136KB

MD5
e04486dc8097446e3ae8ef86f6ad9d11

SHA1
1f10e982bc422a164380669c0e27c42570c8bede

SHA256
d439fd6d159b03c18a483ff80c3f9010867b6ae55e05299d99c09567c8e55670

SHA512
dfb252abfddefd3a265e08c901ed98871c4ac183563e8f3458ab18d5f894b0d6affed077b0fb161261871b0271a341fdcdac0e40b0c48f210c676befae5edd6e

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\.exe
Filesize
82KB

MD5
76985eb01cfab94fedc8b5a88121a8a4

SHA1
dcc87d2a892fec0f9bc17a31ec58ca869a6904c7

SHA256
e1b206c20241adb99a689d28ab5c023e1aab192a05e8cea90f3a2de4727d3442

SHA512
7b7fc3237faada45f218a68b7cb536e7e478a8189361e091ea47a2c181d0c8e3e3968687403468f668d01c8502e2f47f86639fb2da2a4dba007151bff1868b55

Download Submit
memory/4552-10-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4552-20-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4656-0-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download
memory/4656-1-0x0000000000350000-0x00000000003C2000-memory.dmp

Filesize
456KB

Download
memory/4656-12-0x0000000075030000-0x00000000757E0000-memory.dmp

Filesize
7.7MB

Download