marsstealer | 83a7161de690b24c70fa23c2834371ffc892c51f6821d1da765c7e4d30e9c25b

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe
Size 3.8MB
Sample231226-cb5tpadgar
SHA256 b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43
MD5 8669e8f71fd06872bbc1d2399c33d7b1
SHA1 6cdcbc65e5b4d30c3e2e9e3e2c7ad4ed8373bcc5
SHA512 b353fb22d846994f6c09258cccf63f92ae9db14e4dc5965bc67c7c539bdc8f51e599c7bb70a6668d8d6aeacb1551e333ae70630e1ac58f21c49032052dffa847
SSDEEP 12288:zNS9x1JXkDAoqsTAoFhb6lRZu4W1K8waHyu2Um4ytvqMNVw2LW86B7SiU:zeAzW4f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

www.msk-post.com/server/init.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe

Executes dropped EXE 1 IoCs

pid	Process
4196	5P4H56F1CC0FU.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3108	4196	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4196	1696	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe	93
PID 1696 wrote to memory of 4196	1696	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe	93
PID 1696 wrote to memory of 4196	1696	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe	93

C:\Users\Admin\AppData\Local\Temp\b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe
"C:\Users\Admin\AppData\Local\Temp\b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1696
- C:\ProgramData\USOShared\5P4H56F1CC0FU.exe
  "C:\ProgramData\USOShared\5P4H56F1CC0FU.exe"
  2⤵
  - Executes dropped EXE
  PID:4196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 1780
    3⤵
    - Program crash
    PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4196 -ip 4196
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5P4H56F1CC0FU.exe

Path C:\ProgramData\USOShared\5P4H56F1CC0FU.exe
Size 159KB
SHA256 ff90f644a5d0af130cf8d61d0908447a8953d3be58c0ecd8b23f03534df30e4c
MD5 b13a4bddff058d6c9c44d62ecf492563
SHA1 dcf173cf7a9ae1c9b28c92a13bca0b619dee3511
SHA512 7c8611fd762dbd1b77788dc0950323adf751a1a881b855c8b8cf132f4b3515479c56789b1360a028d5704426f37fb4610effb79824c0bc0ea85f2a3d7c638a90
SSDEEP 3072:UrOxlRZc/9T09h6B83gbwUu7KXoLf4rksWAojlhkPXmPUJSp8Bb8EG:CmlRK+9h6B83InOT3kvmw8EG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1696-1-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/1696-0-0x0000000000360000-0x00000000003D2000-memory.dmp

Download

memory/1696-12-0x0000000074430000-0x0000000074BE0000-memory.dmp

Download

memory/4196-10-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4196-20-0x0000000000400000-0x000000000043D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads