marsstealer | 6712664df402066332841e2a18d6d846a5ff23c5a4f78e3cf1b0d1ed74939618

Analysis

max time kernel
160s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2023 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe
Size

8.7MB
MD5

185eb9ebbb379bf2b5dd37e5ed92eee1
SHA1

d9da98bcb2259cb1da248267d1568c3cec591fae
SHA256

21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95
SHA512

45e9cbefef733d17c807e7f316f8be3f464c64008356eaa198802845f450b94f09f8cd2a529941ac57f4a78d5e5c98779d0900d23840ed865859e065ad1a56cc
SSDEEP

12288:FSooBq+S++WsHX+sFICSPSrmjwoCah2mVZ6B7AnebCaLvi4mWY:NYN+SPYK9neSW

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

moscow-post.ru/patch/server/udryhdj.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe

Executes dropped EXE 1 IoCs

Processes:

1A2.exe

pid process

1376 1A2.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2232 1376 WerFault.exe 1A2.exe

pid	process
1376	1A2.exe

pid	pid_target	process	target process
2232	1376	WerFault.exe	1A2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe

description	pid	process	target process
PID 1904 wrote to memory of 1376	1904	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	1A2.exe
PID 1904 wrote to memory of 1376	1904	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	1A2.exe
PID 1904 wrote to memory of 1376	1904	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	1A2.exe

C:\Users\Admin\AppData\Local\Temp\21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe
"C:\Users\Admin\AppData\Local\Temp\21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Roaming\Adobe\1A2.exe
"C:\Users\Admin\AppData\Roaming\Adobe\1A2.exe"
2⤵
- Executes dropped EXE
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1392
3⤵
- Program crash
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1376 -ip 1376
1⤵
PID:3796

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\1A2.exe
Filesize
159KB

MD5
80ffae827667bd2a86cc1d1b17745ba3

SHA1
dae012b46c61ce189319b7d04a7d405db3f733f2

SHA256
dd9285cabf5ff86f34600c4b947c5cb2d442fed6391b14b52c6f0c94c8fff276

SHA512
4ac4ecbd086bd340879676f2c7d3d83b684f0c3ba688dc9a289910c531b1d90ad67c34fc799c51a65c1339d52533aacaed117eedd847fa024232b882908c9442

Download Submit
memory/1376-11-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1376-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1904-0-0x0000000074D20000-0x00000000754D0000-memory.dmp

Filesize
7.7MB

Download
memory/1904-1-0x0000000000010000-0x000000000009E000-memory.dmp

Filesize
568KB

Download
memory/1904-2-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/1904-13-0x0000000074D20000-0x00000000754D0000-memory.dmp

Filesize
7.7MB

Download