Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-04-2024 22:16
Static task
static1
Behavioral task
behavioral1
Sample
Adorable Witch Installer.exe
Resource
win11-20240221-en
General
-
Target
Adorable Witch Installer.exe
-
Size
6.8MB
-
MD5
9df2be3860081eb963d028592fb998f6
-
SHA1
9e93f1f4201ceba6cf7346856acda50fe50bed15
-
SHA256
0ea66c4bb51415da1cd18fb935dbf3f5e8cf671310b9fa9a1f847fdcb6cc46b1
-
SHA512
a3bee2c1825fae431c8a3d547cfbf927628a5ef9f7570ffa277c72bc4368dbebc3ae9a3b3af6401e85c70d62d91bd58524030f75ccaabb080ea2b75ea663a936
-
SSDEEP
12288:StZqbqjCnunwzLipJX3MJxOWM+XnYd3RrnADA+uom/YeBL:StDwUJ8SpoE/YeBL
Malware Config
Extracted
marsstealer
Default
kenesrakishev.net/wp-includes/pomo/po.php
Signatures
-
Mars Stealer
An infostealer written in C++ based on other infostealers.
-
Executes dropped EXE 1 IoCs
Processes:
X7TMTPRWKW7W.exepid process 2184 X7TMTPRWKW7W.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1100 2184 WerFault.exe X7TMTPRWKW7W.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Adorable Witch Installer.exedescription pid process target process PID 4280 wrote to memory of 2184 4280 Adorable Witch Installer.exe X7TMTPRWKW7W.exe PID 4280 wrote to memory of 2184 4280 Adorable Witch Installer.exe X7TMTPRWKW7W.exe PID 4280 wrote to memory of 2184 4280 Adorable Witch Installer.exe X7TMTPRWKW7W.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Adorable Witch Installer.exe"C:\Users\Admin\AppData\Local\Temp\Adorable Witch Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\X7TMTPRWKW7W.exe"C:\ProgramData\X7TMTPRWKW7W.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 18923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2184 -ip 21841⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\X7TMTPRWKW7W.exeFilesize
159KB
MD5ad89890757c177d7d05e2fbea0547772
SHA1da871536caff869ea4a35f351b2fb90c6645b555
SHA2561109fc5e54190e0b50cdc3c455af86887566968cdfb6df59c2bfb566ddb295af
SHA512829584a81473350e2ace4a9ca1f25e3b63e2f7d376e0ff30846f97c91d805df35ff251431956d932d16f60e42846702ae8e53dea6f4bf2175d860983008eed49
-
memory/2184-12-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2184-23-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4280-0-0x0000000000DA0000-0x0000000000E38000-memory.dmpFilesize
608KB
-
memory/4280-1-0x0000000074740000-0x0000000074EF1000-memory.dmpFilesize
7.7MB
-
memory/4280-2-0x0000000005880000-0x0000000005890000-memory.dmpFilesize
64KB
-
memory/4280-13-0x0000000074740000-0x0000000074EF1000-memory.dmpFilesize
7.7MB