marsstealer | cd6b323e455ad47f4b395e8ee8e9a921b5bc22d180f2e1dfcab964ed17857ad0

Analysis

max time kernel
119s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
Size

4.8MB
MD5

b3605edf698023865b1e65852ff9e627
SHA1

93c8ce5f7dd2e69edd50ef26d00f89b4bfbe20b7
SHA256

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255
SHA512

e7a82bbcd5bf3c9799248ecb91837e5f94431e7a1ad5515dd847d1b1cfce44b76e37981694ae14e5f1f30eab3d98088ef4751ce9b8b83ea11bbc1d9c95ea8ad2
SSDEEP

12288:937z0DEczgGtM6oHYuFr7H13jeGeTaGHK4juSAxJWjbA/bJLoGI:WD2twmd

Score

10^/10

marsstealer default stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

Executes dropped EXE 1 IoCs

Processes:

BY0.exe

pid process

1616 BY0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1616	BY0.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe

description	pid	process	target process
PID 4612 wrote to memory of 1616	4612	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	BY0.exe
PID 4612 wrote to memory of 1616	4612	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	BY0.exe
PID 4612 wrote to memory of 1616	4612	3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe	BY0.exe

C:\Users\Admin\AppData\Local\Temp\3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe
"C:\Users\Admin\AppData\Local\Temp\3c71bf86bdeb35c1b8b178e99f3193efabf63a55abebb3356426b731c362a255.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Roaming\Adobe\BY0.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\BY0.exe"
  2⤵
  - Executes dropped EXE
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\BY0.exe

Filesize
159KB

MD5
00333d129e6ef188664819662a141476

SHA1
41605ab3ceffff75a4abd29d2df0fe26bc7de8a1

SHA256
82314104e7bccbced4fbe95a65273d88678b183e45f4fffa8abf2a4ee6a06ee7

SHA512
cb762a2b092fe00ce7c6b99816084dfd6d34d59dde8eb6ccad5f8c031f892f0a495fce7e8600e8fdcd3989f828813a06a5dc23feeb5f2ba7c8c649b9f0a8a150

Download Submit
memory/1616-11-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4612-0-0x0000000000E30000-0x0000000000EA6000-memory.dmp

Filesize
472KB

Download
memory/4612-1-0x0000000075360000-0x0000000075B10000-memory.dmp

Filesize
7.7MB

Download
memory/4612-2-0x0000000005800000-0x0000000005810000-memory.dmp

Filesize
64KB

Download
memory/4612-13-0x0000000075360000-0x0000000075B10000-memory.dmp

Filesize
7.7MB

Download