Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 23:09

General

  • Target

    processlassosetup64.exe

  • Size

    4.9MB

  • MD5

    611e8af3116aa80fafc76d0501fd172e

  • SHA1

    0a82193d9485da25f424c6ff28bdde597fe023a6

  • SHA256

    8faff89242e941f569ee0852ba3463f26741d68b22627d11555b6cee5ef27676

  • SHA512

    1ad6fa695b89e9436c3953609337adfa01f6436e3714bc9268c2a3252fb967d9916c121c611f7416d5fe265a46f5fe891f07d02a02d27a8d6664a2fc0705acb3

  • SSDEEP

    6144:1Ss9IYGOxz2RRKOOCxU873xCswRnBOGLeQ5dBRRW6n5FkjdfJauy:t9/X12qOOCxj3x5whwQl2lauy

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

kenesrakishev.net/wp-load.php

Signatures

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\processlassosetup64.exe
    "C:\Users\Admin\AppData\Local\Temp\processlassosetup64.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\ProgramData\3Z0EV4VTCR.exe
      "C:\ProgramData\3Z0EV4VTCR.exe"
      2⤵
      • Executes dropped EXE
      PID:2608
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1836
        3⤵
        • Program crash
        PID:4380
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2608 -ip 2608
    1⤵
      PID:4468
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:116

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\3Z0EV4VTCR.exe

        Filesize

        159KB

        MD5

        3cc6ddf90e7492c803b3d20142b126cc

        SHA1

        9899b9c40227e604131018ca2f812edf2ef5a32b

        SHA256

        49ab6b67e5bc75c556a1a8248f318943bc697209fdac3f02f2721ded1a375897

        SHA512

        df8e9bb2c77ca4b3d7d22fb10adf4a93f23442d1712f5afad9df2b073bd4d95fb2c658844d6d30b86a79bccd44b4dcd491bd7a5a98b78797cd72c8c704ab0ec8

      • memory/1992-0-0x0000000074AD0000-0x0000000075280000-memory.dmp

        Filesize

        7.7MB

      • memory/1992-1-0x00000000001C0000-0x000000000025E000-memory.dmp

        Filesize

        632KB

      • memory/1992-12-0x0000000074AD0000-0x0000000075280000-memory.dmp

        Filesize

        7.7MB

      • memory/2608-10-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/2608-20-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB