Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03-01-2024 15:08
Static task
static1
Behavioral task
behavioral1
Sample
71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe
Resource
win10v2004-20231215-en
General
-
Target
71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe
-
Size
11.5MB
-
MD5
9386af6fd41ad96b318f63b35ba418c7
-
SHA1
68763a50793e358faf7d089ebd27febdd07e3b77
-
SHA256
71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378
-
SHA512
9344b70e176d9a892f22c5d192a714c19ec2beb6c6d997e72cc2fd8c7103cfeaa670e6f2fd234834ad18647dfbe9b31e12b49156821abf8391236a62261434f8
-
SSDEEP
12288:ytaCEOf6hozmO1LhZU2Pn5zvWKr5zaVTxOWQxBH+QWLoRrW4LbMQbKjVa:trOi70kLej
Malware Config
Extracted
marsstealer
Default
Signatures
-
Mars Stealer
An infostealer written in C++ based on other infostealers.
-
Executes dropped EXE 1 IoCs
Processes:
JP9H88KBRD7DM.exepid process 1080 JP9H88KBRD7DM.exe -
Loads dropped DLL 5 IoCs
Processes:
71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exeWerFault.exepid process 2436 71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe 2436 71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe 2820 WerFault.exe 2820 WerFault.exe 2820 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2820 1080 WerFault.exe JP9H88KBRD7DM.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exeJP9H88KBRD7DM.exedescription pid process target process PID 2436 wrote to memory of 1080 2436 71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe JP9H88KBRD7DM.exe PID 2436 wrote to memory of 1080 2436 71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe JP9H88KBRD7DM.exe PID 2436 wrote to memory of 1080 2436 71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe JP9H88KBRD7DM.exe PID 2436 wrote to memory of 1080 2436 71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe JP9H88KBRD7DM.exe PID 1080 wrote to memory of 2820 1080 JP9H88KBRD7DM.exe WerFault.exe PID 1080 wrote to memory of 2820 1080 JP9H88KBRD7DM.exe WerFault.exe PID 1080 wrote to memory of 2820 1080 JP9H88KBRD7DM.exe WerFault.exe PID 1080 wrote to memory of 2820 1080 JP9H88KBRD7DM.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe"C:\Users\Admin\AppData\Local\Temp\71ea59cbedf3c80b6e47bcd746463de8d82b650e0666183a3bd47bf1b2633378.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Mozilla\JP9H88KBRD7DM.exe"C:\Users\Admin\AppData\Roaming\Mozilla\JP9H88KBRD7DM.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 8123⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Mozilla\JP9H88KBRD7DM.exeFilesize
92KB
MD50f482c362072a91492ce828e92060c64
SHA1073c6c7b9a22794776c2b9a81c3f1c31920f074a
SHA256b631466c4c6ec6f4958cbe990714ee0881f3423e0df3cbe63b6826af7af78148
SHA512bceb0b81f8960096ce04860e45bd04fa3023d4228c57ed506be8bcd90c55796b78edb25efa2a9a463b43167f90dba54105847cc7729820b3d314893855005f31
-
\Users\Admin\AppData\Roaming\Mozilla\JP9H88KBRD7DM.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1080-14-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2436-0-0x0000000001190000-0x0000000001206000-memory.dmpFilesize
472KB
-
memory/2436-1-0x0000000074530000-0x0000000074C1E000-memory.dmpFilesize
6.9MB
-
memory/2436-2-0x0000000004AB0000-0x0000000004AF0000-memory.dmpFilesize
256KB
-
memory/2436-15-0x0000000074530000-0x0000000074C1E000-memory.dmpFilesize
6.9MB
-
memory/2436-13-0x0000000000A60000-0x0000000000A9D000-memory.dmpFilesize
244KB
-
memory/2436-11-0x0000000000A60000-0x0000000000A9D000-memory.dmpFilesize
244KB