marsstealer | 6712664df402066332841e2a18d6d846a5ff23c5a4f78e3cf1b0d1ed74939618

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-12-2023 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe
Size

8.7MB
MD5

185eb9ebbb379bf2b5dd37e5ed92eee1
SHA1

d9da98bcb2259cb1da248267d1568c3cec591fae
SHA256

21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95
SHA512

45e9cbefef733d17c807e7f316f8be3f464c64008356eaa198802845f450b94f09f8cd2a529941ac57f4a78d5e5c98779d0900d23840ed865859e065ad1a56cc
SSDEEP

12288:FSooBq+S++WsHX+sFICSPSrmjwoCah2mVZ6B7AnebCaLvi4mWY:NYN+SPYK9neSW

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Executes dropped EXE 1 IoCs

Processes:

23HNXV1J0KL1W.exe

pid process

1896 23HNXV1J0KL1W.exe

pid	process
1896	23HNXV1J0KL1W.exe

Loads dropped DLL 5 IoCs

Processes:

21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exeWerFault.exe

pid	process
1648	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe
1648	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe
3068	WerFault.exe
3068	WerFault.exe
3068	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3068 1896 WerFault.exe 23HNXV1J0KL1W.exe

pid	pid_target	process	target process
3068	1896	WerFault.exe	23HNXV1J0KL1W.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe23HNXV1J0KL1W.exe

description	pid	process	target process
PID 1648 wrote to memory of 1896	1648	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	23HNXV1J0KL1W.exe
PID 1648 wrote to memory of 1896	1648	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	23HNXV1J0KL1W.exe
PID 1648 wrote to memory of 1896	1648	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	23HNXV1J0KL1W.exe
PID 1648 wrote to memory of 1896	1648	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	23HNXV1J0KL1W.exe
PID 1896 wrote to memory of 3068	1896	23HNXV1J0KL1W.exe	WerFault.exe
PID 1896 wrote to memory of 3068	1896	23HNXV1J0KL1W.exe	WerFault.exe
PID 1896 wrote to memory of 3068	1896	23HNXV1J0KL1W.exe	WerFault.exe
PID 1896 wrote to memory of 3068	1896	23HNXV1J0KL1W.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe
"C:\Users\Admin\AppData\Local\Temp\21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648

C:\ProgramData\Start Menu\23HNXV1J0KL1W.exe
"C:\ProgramData\Start Menu\23HNXV1J0KL1W.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 692
3⤵
- Loads dropped DLL
- Program crash
PID:3068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\23HNXV1J0KL1W.exe
Filesize
159KB

MD5
80ffae827667bd2a86cc1d1b17745ba3

SHA1
dae012b46c61ce189319b7d04a7d405db3f733f2

SHA256
dd9285cabf5ff86f34600c4b947c5cb2d442fed6391b14b52c6f0c94c8fff276

SHA512
4ac4ecbd086bd340879676f2c7d3d83b684f0c3ba688dc9a289910c531b1d90ad67c34fc799c51a65c1339d52533aacaed117eedd847fa024232b882908c9442

Download Submit
memory/1648-0-0x0000000001300000-0x000000000138E000-memory.dmp

Filesize
568KB

Download
memory/1648-1-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/1648-2-0x00000000048B0000-0x00000000048F0000-memory.dmp

Filesize
256KB

Download
memory/1648-12-0x0000000000DC0000-0x0000000000DFD000-memory.dmp

Filesize
244KB

Download
memory/1648-11-0x0000000000DC0000-0x0000000000DFD000-memory.dmp

Filesize
244KB

Download
memory/1648-14-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/1896-13-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download