marsstealer | 3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
Size

4.8MB
MD5

b3605edf698023865b1e65852ff9e627
SHA1

93c8ce5f7dd2e69edd50ef26d00f89b4bfbe20b7
SHA256

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255
SHA512

e7a82bbcd5bf3c9799248ecb91837e5f94431e7a1ad5515dd847d1b1cfce44b76e37981694ae14e5f1f30eab3d98088ef4751ce9b8b83ea11bbc1d9c95ea8ad2
SSDEEP

12288:937z0DEczgGtM6oHYuFr7H13jeGeTaGHK4juSAxJWjbA/bJLoGI:WD2twmd

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Executes dropped EXE 1 IoCs

Processes:

PO1.exe

pid process

1136 PO1.exe

pid	process
1136	PO1.exe

Loads dropped DLL 2 IoCs

Processes:

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

pid	process
2180	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
2180	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

description	pid	process	target process
PID 2180 wrote to memory of 1136	2180	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	PO1.exe
PID 2180 wrote to memory of 1136	2180	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	PO1.exe
PID 2180 wrote to memory of 1136	2180	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	PO1.exe
PID 2180 wrote to memory of 1136	2180	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	PO1.exe

C:\Users\Admin\AppData\Local\Temp\3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
"C:\Users\Admin\AppData\Local\Temp\3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Roaming\Identities\PO1.exe
  "C:\Users\Admin\AppData\Roaming\Identities\PO1.exe"
  2⤵
  - Executes dropped EXE
  PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Identities\PO1.exe

Filesize
159KB

MD5
00333d129e6ef188664819662a141476

SHA1
41605ab3ceffff75a4abd29d2df0fe26bc7de8a1

SHA256
82314104e7bccbced4fbe95a65273d88678b183e45f4fffa8abf2a4ee6a06ee7

SHA512
cb762a2b092fe00ce7c6b99816084dfd6d34d59dde8eb6ccad5f8c031f892f0a495fce7e8600e8fdcd3989f828813a06a5dc23feeb5f2ba7c8c649b9f0a8a150

Download Submit
memory/1136-14-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2180-0-0x0000000000D40000-0x0000000000DB6000-memory.dmp

Filesize
472KB

Download
memory/2180-1-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2180-2-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/2180-11-0x0000000000590000-0x00000000005CD000-memory.dmp

Filesize
244KB

Download
memory/2180-12-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download