Analysis
-
max time kernel
131s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-03-2024 18:39
Behavioral task
behavioral1
Sample
Mars_Stealer_cracked_by_LLCPPC.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
-
Target
Mars_Stealer_cracked_by_LLCPPC.exe
-
Size
93KB
-
MD5
ad4e2f3c8410aa7408fe3dda19a5db67
-
SHA1
0cefc167932d7d037889923536f061d4c64ee38b
-
SHA256
0d4c0d403392a31a1a2ab7b9b478ea3a89cdb14c862990a290ef20adec03437b
-
SHA512
0a191d63b7a40e4c8cf94a34ec2dceec55ca259837a31106fc6f44885a7992fd0ccab019e7122f9ed95efe7f05460354895be0a22c74230949ad874787a78ba1
-
SSDEEP
1536:gWTHVn5wa8TXvqHp6kzWgDaO3C54Gf3lagvHkMTafiyVDr1lVUQ3jy0:gWTHVn8TXvc4O3CFvlaSED1P7j/
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1244 1548 WerFault.exe 85 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4084 taskmgr.exe Token: SeSystemProfilePrivilege 4084 taskmgr.exe Token: SeCreateGlobalPrivilege 4084 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe 4084 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mars_Stealer_cracked_by_LLCPPC.exe"C:\Users\Admin\AppData\Local\Temp\Mars_Stealer_cracked_by_LLCPPC.exe"1⤵PID:1548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 13442⤵
- Program crash
PID:1244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1548 -ip 15481⤵PID:488
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4084