marsstealer | cd6b323e455ad47f4b395e8ee8e9a921b5bc22d180f2e1dfcab964ed17857ad0

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
Size

4.8MB
MD5

b3605edf698023865b1e65852ff9e627
SHA1

93c8ce5f7dd2e69edd50ef26d00f89b4bfbe20b7
SHA256

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255
SHA512

e7a82bbcd5bf3c9799248ecb91837e5f94431e7a1ad5515dd847d1b1cfce44b76e37981694ae14e5f1f30eab3d98088ef4751ce9b8b83ea11bbc1d9c95ea8ad2
SSDEEP

12288:937z0DEczgGtM6oHYuFr7H13jeGeTaGHK4juSAxJWjbA/bJLoGI:WD2twmd

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Executes dropped EXE 1 IoCs

pid	Process
2128	04KK9IU6.exe

Loads dropped DLL 2 IoCs

pid	Process
2292	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
2292	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2128	2292	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	28
PID 2292 wrote to memory of 2128	2292	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	28
PID 2292 wrote to memory of 2128	2292	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	28
PID 2292 wrote to memory of 2128	2292	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	28

C:\Users\Admin\AppData\Local\Temp\3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
"C:\Users\Admin\AppData\Local\Temp\3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\04KK9IU6.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\04KK9IU6.exe"
  2⤵
  - Executes dropped EXE
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\04KK9IU6.exe

Filesize
159KB

MD5
00333d129e6ef188664819662a141476

SHA1
41605ab3ceffff75a4abd29d2df0fe26bc7de8a1

SHA256
82314104e7bccbced4fbe95a65273d88678b183e45f4fffa8abf2a4ee6a06ee7

SHA512
cb762a2b092fe00ce7c6b99816084dfd6d34d59dde8eb6ccad5f8c031f892f0a495fce7e8600e8fdcd3989f828813a06a5dc23feeb5f2ba7c8c649b9f0a8a150

Download Submit
memory/2128-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2292-0-0x00000000009A0000-0x0000000000A16000-memory.dmp

Filesize
472KB

Download
memory/2292-1-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-2-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/2292-12-0x0000000002100000-0x000000000213D000-memory.dmp

Filesize
244KB

Download
memory/2292-14-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-13-0x0000000002100000-0x000000000213D000-memory.dmp

Filesize
244KB

Download