Analysis
-
max time kernel
90s -
max time network
142s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-04-2024 22:16
Static task
static1
Behavioral task
behavioral1
Sample
PERM Flow Chart (5).pdf.exe
Resource
win11-20240221-en
General
-
Target
PERM Flow Chart (5).pdf.exe
-
Size
614KB
-
MD5
a74c9036ba18a91d23733f21f0965352
-
SHA1
f39eb55e6fc74d112e7e3b8f72053cf139f1f6d1
-
SHA256
9cc1d2cf5e3b394fbb7f4d470b6c4e094aa8691fc759f9f75faa88a5772c882b
-
SHA512
1cfaed9b4ba552e70f035b326e49b003afc46b4cdfe872a729d6359d835d37864187994815f9a2e18be794888475553648bf4b2f1a6e8b96f64d9bd1691d034f
-
SSDEEP
12288:6jLIHe+qdOqQ/H6OKnA5feEq8sdvuxi+vC/tKJ+2BAMSsjgZeS1I/XUta93poy:CRtwtvagbCy
Malware Config
Extracted
marsstealer
Default
kenesrakishev.net/wp-includes/pomo/po.php
Signatures
-
Mars Stealer
An infostealer written in C++ based on other infostealers.
-
Executes dropped EXE 1 IoCs
Processes:
SYZQSPKOD56LNO.exepid process 4484 SYZQSPKOD56LNO.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1328 4484 WerFault.exe SYZQSPKOD56LNO.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
PERM Flow Chart (5).pdf.exedescription pid process target process PID 5068 wrote to memory of 4484 5068 PERM Flow Chart (5).pdf.exe SYZQSPKOD56LNO.exe PID 5068 wrote to memory of 4484 5068 PERM Flow Chart (5).pdf.exe SYZQSPKOD56LNO.exe PID 5068 wrote to memory of 4484 5068 PERM Flow Chart (5).pdf.exe SYZQSPKOD56LNO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PERM Flow Chart (5).pdf.exe"C:\Users\Admin\AppData\Local\Temp\PERM Flow Chart (5).pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\SYZQSPKOD56LNO.exe"C:\ProgramData\SYZQSPKOD56LNO.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 19163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4484 -ip 44841⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\SYZQSPKOD56LNO.exeFilesize
159KB
MD514878fb96760ba869271109d832f43a7
SHA1874f6bcac3ef5682a567483ea5627d38bfbffa8d
SHA2560c816842e7a1649f0010b7c437a7783f82fd8a62a080adaeaecd871e6578c721
SHA512f882cfb373f79e823e3284b6dbe09d7df0ea90d0ab20e9399e1ee3af86eec2e8ba5c3b882f6b7f88b0478bc3fdfe05e033ee6fcbc2813faf13558fbec1d0a2e2
-
memory/4484-12-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4484-23-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/5068-0-0x0000000000530000-0x00000000005CE000-memory.dmpFilesize
632KB
-
memory/5068-1-0x0000000074510000-0x0000000074CC1000-memory.dmpFilesize
7.7MB
-
memory/5068-2-0x00000000050A0000-0x00000000050B0000-memory.dmpFilesize
64KB
-
memory/5068-13-0x0000000074510000-0x0000000074CC1000-memory.dmpFilesize
7.7MB