marsstealer | 1440-11-0x0000000000400000-0x000000000043D000-memory[.]dmp | Triage

Sharing

General

Target

1440-11-0x0000000000400000-0x000000000043D000-memory.dmp
Size

244KB
MD5

1ec6fe1edf31e5e317ab20542d4a4397
SHA1

112e307777164455a6a3807800b0e420469e2695
SHA256

dfda69d80802172b02120e93868c4c4a0cfc122b9e3ce24d5a2a76c1222252e9
SHA512

21d9903e12011f3bd21f0bf49d130c469c1bbb80c448b0c798be9a87b2896fdfbc9adff78ad9621be64f81d11e3ffbe88353ed6c7427a8726d866a7a086df4aa
SSDEEP

3072:Um/E8k9ZjpIL+zNch12KbAwSaSSJSp8Fb8EG:N/E8k91zz6/tN8EG

Score

10^/10

default marsstealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Signatures

Marsstealer family
marsstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
1440-11-0x0000000000400000-0x000000000043D000-memory.dmp

Files

1440-11-0x0000000000400000-0x000000000043D000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 114KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 1024B - Virtual size: 864B

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE