marsstealer | 83a7161de690b24c70fa23c2834371ffc892c51f6821d1da765c7e4d30e9c25b

Analysis

max time kernel
140s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe
Size

3.8MB
MD5

8669e8f71fd06872bbc1d2399c33d7b1
SHA1

6cdcbc65e5b4d30c3e2e9e3e2c7ad4ed8373bcc5
SHA256

b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43
SHA512

b353fb22d846994f6c09258cccf63f92ae9db14e4dc5965bc67c7c539bdc8f51e599c7bb70a6668d8d6aeacb1551e333ae70630e1ac58f21c49032052dffa847
SSDEEP

12288:zNS9x1JXkDAoqsTAoFhb6lRZu4W1K8waHyu2Um4ytvqMNVw2LW86B7SiU:zeAzW4f

Score

10^/10

marsstealer default discovery stealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

www.msk-post.com/server/init.php

Signatures

Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe

Executes dropped EXE 1 IoCs

pid	Process
444	4DZN42QMHQBF9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4DZN42QMHQBF9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 444	4380	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe	86
PID 4380 wrote to memory of 444	4380	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe	86
PID 4380 wrote to memory of 444	4380	b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe	86

C:\Users\Admin\AppData\Local\Temp\b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe
"C:\Users\Admin\AppData\Local\Temp\b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380
- C:\ProgramData\USOShared\4DZN42QMHQBF9.exe
  "C:\ProgramData\USOShared\4DZN42QMHQBF9.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\USOShared\4DZN42QMHQBF9.exe

Filesize
159KB

MD5
b13a4bddff058d6c9c44d62ecf492563

SHA1
dcf173cf7a9ae1c9b28c92a13bca0b619dee3511

SHA256
ff90f644a5d0af130cf8d61d0908447a8953d3be58c0ecd8b23f03534df30e4c

SHA512
7c8611fd762dbd1b77788dc0950323adf751a1a881b855c8b8cf132f4b3515479c56789b1360a028d5704426f37fb4610effb79824c0bc0ea85f2a3d7c638a90

Download Submit
memory/444-9-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/444-18-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4380-0-0x00000000745EE000-0x00000000745EF000-memory.dmp

Filesize
4KB

Download
memory/4380-1-0x0000000000080000-0x00000000000F2000-memory.dmp

Filesize
456KB

Download