Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2024 21:26
Static task
static1
Behavioral task
behavioral1
Sample
Adorable Witch Installer.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Adorable Witch Installer.exe
Resource
win10v2004-20240226-en
General
-
Target
Adorable Witch Installer.exe
-
Size
6.8MB
-
MD5
9df2be3860081eb963d028592fb998f6
-
SHA1
9e93f1f4201ceba6cf7346856acda50fe50bed15
-
SHA256
0ea66c4bb51415da1cd18fb935dbf3f5e8cf671310b9fa9a1f847fdcb6cc46b1
-
SHA512
a3bee2c1825fae431c8a3d547cfbf927628a5ef9f7570ffa277c72bc4368dbebc3ae9a3b3af6401e85c70d62d91bd58524030f75ccaabb080ea2b75ea663a936
-
SSDEEP
12288:StZqbqjCnunwzLipJX3MJxOWM+XnYd3RrnADA+uom/YeBL:StDwUJ8SpoE/YeBL
Malware Config
Extracted
marsstealer
Default
kenesrakishev.net/wp-includes/pomo/po.php
Signatures
-
Mars Stealer
An infostealer written in C++ based on other infostealers.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Adorable Witch Installer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation Adorable Witch Installer.exe -
Executes dropped EXE 1 IoCs
Processes:
BYN8PQQIPK.exepid process 5016 BYN8PQQIPK.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 232 5016 WerFault.exe BYN8PQQIPK.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Adorable Witch Installer.exedescription pid process target process PID 1596 wrote to memory of 5016 1596 Adorable Witch Installer.exe BYN8PQQIPK.exe PID 1596 wrote to memory of 5016 1596 Adorable Witch Installer.exe BYN8PQQIPK.exe PID 1596 wrote to memory of 5016 1596 Adorable Witch Installer.exe BYN8PQQIPK.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Adorable Witch Installer.exe"C:\Users\Admin\AppData\Local\Temp\Adorable Witch Installer.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\BYN8PQQIPK.exe"C:\ProgramData\BYN8PQQIPK.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 16603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 50161⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\BYN8PQQIPK.exeFilesize
159KB
MD5ad89890757c177d7d05e2fbea0547772
SHA1da871536caff869ea4a35f351b2fb90c6645b555
SHA2561109fc5e54190e0b50cdc3c455af86887566968cdfb6df59c2bfb566ddb295af
SHA512829584a81473350e2ace4a9ca1f25e3b63e2f7d376e0ff30846f97c91d805df35ff251431956d932d16f60e42846702ae8e53dea6f4bf2175d860983008eed49
-
memory/1596-0-0x0000000000A70000-0x0000000000B08000-memory.dmpFilesize
608KB
-
memory/1596-1-0x00000000748E0000-0x0000000075090000-memory.dmpFilesize
7.7MB
-
memory/1596-2-0x00000000055D0000-0x00000000055E0000-memory.dmpFilesize
64KB
-
memory/1596-13-0x00000000748E0000-0x0000000075090000-memory.dmpFilesize
7.7MB
-
memory/5016-12-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/5016-21-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB