marsstealer | 61b5c2f0dd54539e5baea9155aaca72c8fd6f12279083511d4d3eccd9e360f9b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3e2fbe15176a56ac45f26368b80b3fc.exe
Size

159KB
MD5

a3e2fbe15176a56ac45f26368b80b3fc
SHA1

a0431e50317a2c6c94aade1a10be6f20f62ad436
SHA256

61b5c2f0dd54539e5baea9155aaca72c8fd6f12279083511d4d3eccd9e360f9b
SHA512

26f7e48275c7565405ca94a15b0414acfbc824979627ed9b48d3dfc5360e8c0cd93227f00df9ed54435ab79a84b0771a0323a6e37448ff15481ed84b92a2f3ac
SSDEEP

3072:UemE6vyiPCkN0sVKOUP+qU16bQGTt/OgmyNFrnPKDNJSp8Bb8EG:UrSUm+TNG5/Og9frnW8EG

Score

10^/10

marsstealer default discovery spyware stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

couriercare.in/2/gate.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2764 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

a3e2fbe15176a56ac45f26368b80b3fc.exe

pid process

2352 a3e2fbe15176a56ac45f26368b80b3fc.exe
2352 a3e2fbe15176a56ac45f26368b80b3fc.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2764	cmd.exe

pid	process
2352	a3e2fbe15176a56ac45f26368b80b3fc.exe
2352	a3e2fbe15176a56ac45f26368b80b3fc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a3e2fbe15176a56ac45f26368b80b3fc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a3e2fbe15176a56ac45f26368b80b3fc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a3e2fbe15176a56ac45f26368b80b3fc.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1640 timeout.exe

pid	process
1640	timeout.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a3e2fbe15176a56ac45f26368b80b3fc.execmd.exe

description	pid	process	target process
PID 2352 wrote to memory of 2764	2352	a3e2fbe15176a56ac45f26368b80b3fc.exe	cmd.exe
PID 2352 wrote to memory of 2764	2352	a3e2fbe15176a56ac45f26368b80b3fc.exe	cmd.exe
PID 2352 wrote to memory of 2764	2352	a3e2fbe15176a56ac45f26368b80b3fc.exe	cmd.exe
PID 2352 wrote to memory of 2764	2352	a3e2fbe15176a56ac45f26368b80b3fc.exe	cmd.exe
PID 2764 wrote to memory of 1640	2764	cmd.exe	timeout.exe
PID 2764 wrote to memory of 1640	2764	cmd.exe	timeout.exe
PID 2764 wrote to memory of 1640	2764	cmd.exe	timeout.exe
PID 2764 wrote to memory of 1640	2764	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\a3e2fbe15176a56ac45f26368b80b3fc.exe
"C:\Users\Admin\AppData\Local\Temp\a3e2fbe15176a56ac45f26368b80b3fc.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a3e2fbe15176a56ac45f26368b80b3fc.exe" & exit
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
3⤵
- Delays execution with timeout.exe
PID:1640

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\mozglue.dll
Filesize
133KB

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
Filesize
539KB

MD5
fbea52539c7eb0bf532a3f655f882add

SHA1
dc85fc980304e5dd8ba25804ad9e1e1fa609e713

SHA256
872cd9c5a820b97c98b11c3199c143aab3fdb450eb0171814fb040e5eea29abd

SHA512
7d783cb2b58c6a8283c2a1ac5997569b42c69a4a94e6609b874021ac3c6293e3a6c31b5d0a9daa18f0d050b4b9bce03f02c520ad149e4fbb1f43137fe7e7d4ef

Download Submit
memory/2352-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2352-1-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2352-50-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download