Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2023 01:23
Static task
static1
Behavioral task
behavioral1
Sample
791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe
Resource
win10v2004-20231215-en
General
-
Target
791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe
-
Size
13.4MB
-
MD5
6e08d023664e3f4e835ec3ec198b883a
-
SHA1
43f2f3321a51f1ca308af891d2e1dbaaee48b045
-
SHA256
791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad
-
SHA512
41d44ed76ecda43eab891a2e07cb43481478c39797e44ed017654a8bca346b90bfcf4f444532d8e9765173c2e9b26d5f524fe42ec9a7830230fedbe21f9e0ec1
-
SSDEEP
12288:bu5DqC9/n1D0jAV8eCeoIl1TroJMExsi+vakV7tbQ3KtwU:buDXVsUThTFyJm
Malware Config
Extracted
marsstealer
Default
moscow-post.com/xaoniu/server/waungowangued/g.php
Signatures
-
Mars Stealer
An infostealer written in C++ based on other infostealers.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe -
Executes dropped EXE 1 IoCs
Processes:
A6XFCDNE2.exepid process 1896 A6XFCDNE2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 852 1896 WerFault.exe A6XFCDNE2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exedescription pid process target process PID 2172 wrote to memory of 1896 2172 791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe A6XFCDNE2.exe PID 2172 wrote to memory of 1896 2172 791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe A6XFCDNE2.exe PID 2172 wrote to memory of 1896 2172 791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe A6XFCDNE2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe"C:\Users\Admin\AppData\Local\Temp\791cb146ce71d27b52dd233a80f5ac4e63f69d49af07a53850954da93ff439ad.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A6XFCDNE2.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A6XFCDNE2.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 14163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1896 -ip 18961⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\A6XFCDNE2.exeFilesize
159KB
MD5a103174262d8c3fd501ffb95323c60b1
SHA1e40f0dd566ba3d50886d3f9e82bf2c108370d62b
SHA256bc65e75fcfee4ff9655005f8496f7c86feb892f0caec33c2208e8381cb967248
SHA512a023dd3997474d427d963a23ccbe7091fdda53d8fde1e1c43eb2e67090a27bd1b0f9eee08757993125cfe10683c38ab0db2194a5847ff51e39d636357c381da2
-
memory/1896-12-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1896-15-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2172-0-0x0000000000A90000-0x0000000000B12000-memory.dmpFilesize
520KB
-
memory/2172-1-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/2172-2-0x00000000054E0000-0x00000000054F0000-memory.dmpFilesize
64KB
-
memory/2172-13-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB