Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 00:03
Static task
static1
Behavioral task
behavioral1
Sample
YoudaoDict.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
YoudaoDict.exe
Resource
win10v2004-20231215-en
General
-
Target
YoudaoDict.exe
-
Size
6.8MB
-
MD5
ff3d9c5dcde804a90e862de9c1d32a8c
-
SHA1
04b0da40346d661a11e9e899daec104ee77c6606
-
SHA256
a238bd522702802eb2a2b71b4b00a1a1553b1c2fff0d8b9e50b13e999cabbdf3
-
SHA512
288e716dd70bedd1cebdc7582f44d969050de9ffe387ae0b9363937fc41b62eedb1faba1fd0cead9a05ba96a880df4d00727e60cde2606a16849e8a5cf266ac3
-
SSDEEP
12288:IPvAXg30gk3yrkb+/nCSnilwUOSFaoAiTI2MHPwrQKUs6:IgpbOROQ3s6
Malware Config
Extracted
marsstealer
Default
Signatures
-
Mars Stealer
An infostealer written in C++ based on other infostealers.
-
Executes dropped EXE 1 IoCs
Processes:
BJC701T.exepid process 1064 BJC701T.exe -
Loads dropped DLL 5 IoCs
Processes:
YoudaoDict.exeWerFault.exepid process 3024 YoudaoDict.exe 3024 YoudaoDict.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2676 1064 WerFault.exe BJC701T.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
YoudaoDict.exeBJC701T.exedescription pid process target process PID 3024 wrote to memory of 1064 3024 YoudaoDict.exe BJC701T.exe PID 3024 wrote to memory of 1064 3024 YoudaoDict.exe BJC701T.exe PID 3024 wrote to memory of 1064 3024 YoudaoDict.exe BJC701T.exe PID 3024 wrote to memory of 1064 3024 YoudaoDict.exe BJC701T.exe PID 1064 wrote to memory of 2676 1064 BJC701T.exe WerFault.exe PID 1064 wrote to memory of 2676 1064 BJC701T.exe WerFault.exe PID 1064 wrote to memory of 2676 1064 BJC701T.exe WerFault.exe PID 1064 wrote to memory of 2676 1064 BJC701T.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\YoudaoDict.exe"C:\Users\Admin\AppData\Local\Temp\YoudaoDict.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\BJC701T.exe"C:\ProgramData\BJC701T.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 6363⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\BJC701T.exeFilesize
92KB
MD500c60868dfc94cdc0b2d2453a4a42b02
SHA157ef196e7def8eeda550f65cb2c9cca617faf4c3
SHA2567c488a794e11a1ca69181ce171d77d19e1f097d2f043ffa4b36b1671435a21ab
SHA512274903117bde982b0ab36474049f41855c4cfa3319b44a790b27fbbc1663349819f4f6385f5656e2d96023661228056553c8da85755ab19a45ec009d70633463
-
C:\ProgramData\BJC701T.exeFilesize
159KB
MD5355142538822114c3357d73d35769ff2
SHA185d6d7b919f60c39cc8a3d65bf574877c3a7590f
SHA2564dc9b6823e021a19ff259c5f0fcc2a023b0dea26adde9e08f1278ba103fdd3cc
SHA5129099f85fe484df4678e106373630427b8578d73bcea1bf7ba81eb9be4578d607acc50fa1ba97bd063edc1ed9bb27328552aabf2ca3dc0837841f348ceb7689e4
-
\ProgramData\BJC701T.exeFilesize
121KB
MD5d661046b0fdd2675035371ab7ffaf4c7
SHA1f4eda3887644c550cb3f59c1f615bbefd70f473e
SHA2560b749b60140f486eeea9b880d5003c3b45369054963cb46cadf206ccdd2640e5
SHA512a864b08fc3c74527fbcd1792641b6ff03833fe261a69d808d27c9203d80b7b87b9dc300c841aeeeb91c97066d361c186053ea05140cdd7c82cbca2992556eab8
-
\ProgramData\BJC701T.exeFilesize
93KB
MD5352655d7a88f03171b610ae9ef550b00
SHA14e3852a3bf8d06aa8ec6b9012c6325ce093cf1a6
SHA25639afe57637200aa0a276de538c5be74c4d768fbe4850d69021afd3cc12c86f10
SHA512c154c9aff74940310b7ecea036b67fa8cdf1ea48c0b20a89f6e06cbe9134ee65ab4b82d136c3f81c2ccd9cc4b30f757596d781122b7b94021a47e4d755c0f567
-
memory/1064-14-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3024-0-0x00000000011A0000-0x0000000001228000-memory.dmpFilesize
544KB
-
memory/3024-1-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/3024-12-0x0000000000790000-0x00000000007CD000-memory.dmpFilesize
244KB
-
memory/3024-13-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/3024-11-0x0000000000790000-0x00000000007CD000-memory.dmpFilesize
244KB