Analysis
- max time kernel
72s - max time network
76s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
25/12/2023, 04:02
General
- Target The Summer Waifu.exe
- Size 5.7MB
- Sample231225-els9rafbb7
- SHA256 9d15283240ff79899aeb0f2866c51b75d953e5c04a8069397734a3cb6aef87af
Score
10/10
Malware Config
Extracted
Family
-
marsstealer
Botnet
-
Default
Signatures
- Mars Stealer
An infostealer written in C++ based on other infostealers.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\The Summer Waifu.exe"C:\Users\Admin\AppData\Local\Temp\The Summer Waifu.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Identities\CKTI.exe"C:\Users\Admin\AppData\Roaming\Identities\CKTI.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
CKTI.exe
memory/2172-13-0x0000000000400000-0x000000000043D000-memory.dmp
memory/2456-0-0x0000000001190000-0x0000000001204000-memory.dmp
memory/2456-1-0x0000000074D00000-0x00000000753EE000-memory.dmp
memory/2456-2-0x0000000004EA0000-0x0000000004EE0000-memory.dmp
memory/2456-14-0x0000000000C50000-0x0000000000C8D000-memory.dmp
memory/2456-15-0x0000000074D00000-0x00000000753EE000-memory.dmp
memory/2456-12-0x0000000000C50000-0x0000000000C8D000-memory.dmp