marsstealer | b7737850b4f9843c60a23ca39b81fecdb60a04fbcd5839326f854f0a092f95c5

Analysis

max time kernel
142s
max time network
148s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
04-04-2024 00:59

Target

Gammadyne Mailer.exe
Size

668KB
MD5

1ff8f5b71d19c4faffa31dfdc21fd263
SHA1

cb42386f7fd958812ffcfff9b0c107158eca5994
SHA256

b7737850b4f9843c60a23ca39b81fecdb60a04fbcd5839326f854f0a092f95c5
SHA512

74a1e83bc9a03ffadf78c18a7bb056724c17b6dce3e85ed214282ca38adb47d52a3f8c48c82a1b9c25014c7739f4dcd18faf3a6b81bf90247f6d3086d16698fa
SSDEEP

12288:jkZbvRx3JGXdvLI/tt5AzzCRlr+RGc6xyArqg5GnD8LVduHRvBHnVr7MHWrgcli7:xRWy68/ghD7q

Score

10^/10

Family

marsstealer

Botnet

Default

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Executes dropped EXE 1 IoCs

Processes:

QZOEYPXDACG.exe

pid process

1364 QZOEYPXDACG.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1364	QZOEYPXDACG.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Gammadyne Mailer.exe

description	pid	process	target process
PID 3996 wrote to memory of 1364	3996	Gammadyne Mailer.exe	QZOEYPXDACG.exe
PID 3996 wrote to memory of 1364	3996	Gammadyne Mailer.exe	QZOEYPXDACG.exe
PID 3996 wrote to memory of 1364	3996	Gammadyne Mailer.exe	QZOEYPXDACG.exe

C:\Users\Admin\AppData\Local\Temp\Gammadyne Mailer.exe
"C:\Users\Admin\AppData\Local\Temp\Gammadyne Mailer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3996

C:\Users\Admin\AppData\Local\Temp\QZOEYPXDACG.exe
"C:\Users\Admin\AppData\Local\Temp\QZOEYPXDACG.exe"
2⤵
- Executes dropped EXE
PID:1364

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\QZOEYPXDACG.exe
Filesize
159KB

MD5
92302995a9204718c11d721b3b8b3edd

SHA1
f018ecd683ba6cb7e3aa075b4eb92c1ba4b8a2a9

SHA256
8a09643eaff0b5e8fb553b92282ec01baa9c9f6a2990ae7f7cdb11db6216b098

SHA512
f862bd8f745ec016a63de3d59e31a97186229244c851c38a4b5abfab32535b3817f35afdcd0b082c4ff4de1e64d9f44c83f9daec212ec7c8614c59dec97598e5

Download Submit
memory/1364-9-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3996-0-0x0000000000AF0000-0x0000000000B9C000-memory.dmp

Filesize
688KB

Download
memory/3996-1-0x00000000738D0000-0x0000000073FBE000-memory.dmp

Filesize
6.9MB

Download
memory/3996-2-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/3996-10-0x00000000738D0000-0x0000000073FBE000-memory.dmp

Filesize
6.9MB

Download