marsstealer | 6712664df402066332841e2a18d6d846a5ff23c5a4f78e3cf1b0d1ed74939618

Analysis

max time kernel
160s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2023, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe
Size 8.7MB
Sample231227-bc9nlaeeb9
SHA256 21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95
MD5 185eb9ebbb379bf2b5dd37e5ed92eee1
SHA1 d9da98bcb2259cb1da248267d1568c3cec591fae
SHA512 45e9cbefef733d17c807e7f316f8be3f464c64008356eaa198802845f450b94f09f8cd2a529941ac57f4a78d5e5c98779d0900d23840ed865859e065ad1a56cc
SSDEEP 12288:FSooBq+S++WsHX+sFICSPSrmjwoCah2mVZ6B7AnebCaLvi4mWY:NYN+SPYK9neSW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

marsstealer default spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

moscow-post.ru/patch/server/udryhdj.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe

Executes dropped EXE 1 IoCs

pid	Process
1376	1A2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	1376	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1376	1904	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	91
PID 1904 wrote to memory of 1376	1904	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	91
PID 1904 wrote to memory of 1376	1904	21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe	91

C:\Users\Admin\AppData\Local\Temp\21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe
"C:\Users\Admin\AppData\Local\Temp\21a174a42902e4e830e224ea8943c76f1a0730edafa280a99b09b5597c96af95.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Roaming\Adobe\1A2.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\1A2.exe"
  2⤵
  - Executes dropped EXE
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1392
    3⤵
    - Program crash
    PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1376 -ip 1376
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1A2.exe

Path C:\Users\Admin\AppData\Roaming\Adobe\1A2.exe
Size 159KB
SHA256 dd9285cabf5ff86f34600c4b947c5cb2d442fed6391b14b52c6f0c94c8fff276
MD5 80ffae827667bd2a86cc1d1b17745ba3
SHA1 dae012b46c61ce189319b7d04a7d405db3f733f2
SHA512 4ac4ecbd086bd340879676f2c7d3d83b684f0c3ba688dc9a289910c531b1d90ad67c34fc799c51a65c1339d52533aacaed117eedd847fa024232b882908c9442
SSDEEP 3072:UUBeCMbNQCFoYSfQCzLafdWYkNuK6/n5VXBok6S8aPZP0q4utvvJSp8Bb8EG:lofbKCFovQCz6dVPK6/n5V56jaPZMCDe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1376-11-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1376-15-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1904-0-0x0000000074D20000-0x00000000754D0000-memory.dmp

Download

memory/1904-1-0x0000000000010000-0x000000000009E000-memory.dmp

Download

memory/1904-2-0x0000000004A50000-0x0000000004A60000-memory.dmp

Download

memory/1904-13-0x0000000074D20000-0x00000000754D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads