marsstealer | 21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95

Analysis

max time kernel
17s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ARK_Trainer_v0.9.9.9.exe
Size

8.7MB
MD5

185eb9ebbb379bf2b5dd37e5ed92eee1
SHA1

d9da98bcb2259cb1da248267d1568c3cec591fae
SHA256

21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95
SHA512

45e9cbefef733d17c807e7f316f8be3f464c64008356eaa198802845f450b94f09f8cd2a529941ac57f4a78d5e5c98779d0900d23840ed865859e065ad1a56cc
SSDEEP

12288:FSooBq+S++WsHX+sFICSPSrmjwoCah2mVZ6B7AnebCaLvi4mWY:NYN+SPYK9neSW

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

moscow-post.ru/patch/server/udryhdj.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ARK_Trainer_v0.9.9.9.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	ARK_Trainer_v0.9.9.9.exe

Executes dropped EXE 1 IoCs

Processes:

VNC13YMPA0D.exe

pid process

4916 VNC13YMPA0D.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3784 4916 WerFault.exe VNC13YMPA0D.exe

pid	process
4916	VNC13YMPA0D.exe

pid	pid_target	process	target process
3784	4916	WerFault.exe	VNC13YMPA0D.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ARK_Trainer_v0.9.9.9.exe

description	pid	process	target process
PID 2036 wrote to memory of 4916	2036	ARK_Trainer_v0.9.9.9.exe	VNC13YMPA0D.exe
PID 2036 wrote to memory of 4916	2036	ARK_Trainer_v0.9.9.9.exe	VNC13YMPA0D.exe
PID 2036 wrote to memory of 4916	2036	ARK_Trainer_v0.9.9.9.exe	VNC13YMPA0D.exe

C:\Users\Admin\AppData\Local\Temp\ARK_Trainer_v0.9.9.9.exe
"C:\Users\Admin\AppData\Local\Temp\ARK_Trainer_v0.9.9.9.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2036

C:\ProgramData\Start Menu\VNC13YMPA0D.exe
"C:\ProgramData\Start Menu\VNC13YMPA0D.exe"
2⤵
- Executes dropped EXE
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 1432
3⤵
- Program crash
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4916 -ip 4916
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-1-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/2036-0-0x0000000000F50000-0x0000000000FDE000-memory.dmp

Filesize
568KB

Download
memory/2036-2-0x0000000005940000-0x0000000005950000-memory.dmp

Filesize
64KB

Download
memory/2036-14-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/4916-13-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4916-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download