marsstealer | 83a7161de690b24c70fa23c2834371ffc892c51f6821d1da765c7e4d30e9c25b

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe
Size

3.8MB
MD5

8669e8f71fd06872bbc1d2399c33d7b1
SHA1

6cdcbc65e5b4d30c3e2e9e3e2c7ad4ed8373bcc5
SHA256

b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43
SHA512

b353fb22d846994f6c09258cccf63f92ae9db14e4dc5965bc67c7c539bdc8f51e599c7bb70a6668d8d6aeacb1551e333ae70630e1ac58f21c49032052dffa847
SSDEEP

12288:zNS9x1JXkDAoqsTAoFhb6lRZu4W1K8waHyu2Um4ytvqMNVw2LW86B7SiU:zeAzW4f

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

www.msk-post.com/server/init.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe

Executes dropped EXE 1 IoCs

Processes:

5P4H56F1CC0FU.exe

pid process

4196 5P4H56F1CC0FU.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3108 4196 WerFault.exe 5P4H56F1CC0FU.exe

pid	process
4196	5P4H56F1CC0FU.exe

pid	pid_target	process	target process
3108	4196	WerFault.exe	5P4H56F1CC0FU.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe

description	pid	process	target process
PID 1696 wrote to memory of 4196	1696	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe	5P4H56F1CC0FU.exe
PID 1696 wrote to memory of 4196	1696	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe	5P4H56F1CC0FU.exe
PID 1696 wrote to memory of 4196	1696	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe	5P4H56F1CC0FU.exe

C:\Users\Admin\AppData\Local\Temp\b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe
"C:\Users\Admin\AppData\Local\Temp\b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1696

C:\ProgramData\USOShared\5P4H56F1CC0FU.exe
"C:\ProgramData\USOShared\5P4H56F1CC0FU.exe"
2⤵
- Executes dropped EXE
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 1780
3⤵
- Program crash
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4196 -ip 4196
1⤵
PID:3804

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\USOShared\5P4H56F1CC0FU.exe
Filesize
159KB

MD5
b13a4bddff058d6c9c44d62ecf492563

SHA1
dcf173cf7a9ae1c9b28c92a13bca0b619dee3511

SHA256
ff90f644a5d0af130cf8d61d0908447a8953d3be58c0ecd8b23f03534df30e4c

SHA512
7c8611fd762dbd1b77788dc0950323adf751a1a881b855c8b8cf132f4b3515479c56789b1360a028d5704426f37fb4610effb79824c0bc0ea85f2a3d7c638a90

Download Submit
memory/1696-1-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/1696-0-0x0000000000360000-0x00000000003D2000-memory.dmp

Filesize
456KB

Download
memory/1696-12-0x0000000074430000-0x0000000074BE0000-memory.dmp

Filesize
7.7MB

Download
memory/4196-10-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4196-20-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download