marsstealer | fcec85746f0f2a92b1268830d6d0b075eb9080707358b93ba5fbd917b1a0a8ea

Resubmissions

28-09-2024 17:55

240928-whvrva1epa 10

30-08-2024 09:50

240830-lvc3fsxgqf 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MarsStealer8_cracked_by_LLCPPC.exe
Size

159KB
MD5

caa1ddfbbe03a5a5daeb718605daacb0
SHA1

1dc62e3529aaafb20c3ca16697deb5cf6792d83f
SHA256

fcec85746f0f2a92b1268830d6d0b075eb9080707358b93ba5fbd917b1a0a8ea
SHA512

fb805afdf01603eb5af3ee8807fcd42a04e49d3a106e945fa9ab57a68a5068bdfc19a685213d3601be228dfbfae52315953e2400be9051a283f6df0923518ce7
SSDEEP

3072:Um/E8k9ZjpIL+zNch12KbAwSaSbJSp8Bb8EG:N/E8k91zz6/t88EG

Score

10^/10

marsstealer default discovery stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

536 2004 WerFault.exe MarsStealer8_cracked_by_LLCPPC.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

MarsStealer8_cracked_by_LLCPPC.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MarsStealer8_cracked_by_LLCPPC.exe

pid	pid_target	process	target process
536	2004	WerFault.exe	MarsStealer8_cracked_by_LLCPPC.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarsStealer8_cracked_by_LLCPPC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

MarsStealer8_cracked_by_LLCPPC.exe

description	pid	process	target process
PID 2004 wrote to memory of 536	2004	MarsStealer8_cracked_by_LLCPPC.exe	WerFault.exe
PID 2004 wrote to memory of 536	2004	MarsStealer8_cracked_by_LLCPPC.exe	WerFault.exe
PID 2004 wrote to memory of 536	2004	MarsStealer8_cracked_by_LLCPPC.exe	WerFault.exe
PID 2004 wrote to memory of 536	2004	MarsStealer8_cracked_by_LLCPPC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MarsStealer8_cracked_by_LLCPPC.exe
"C:\Users\Admin\AppData\Local\Temp\MarsStealer8_cracked_by_LLCPPC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 508
  2⤵
  - Program crash
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2004-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download