Overview

overview

10

Static

static

3

b7d757263a...43.exe

windows7-x64

10

b7d757263a...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 10:10 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe

  • Size

    3.8MB

  • MD5

    8669e8f71fd06872bbc1d2399c33d7b1

  • SHA1

    6cdcbc65e5b4d30c3e2e9e3e2c7ad4ed8373bcc5

  • SHA256

    b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43

  • SHA512

    b353fb22d846994f6c09258cccf63f92ae9db14e4dc5965bc67c7c539bdc8f51e599c7bb70a6668d8d6aeacb1551e333ae70630e1ac58f21c49032052dffa847

  • SSDEEP

    12288:zNS9x1JXkDAoqsTAoFhb6lRZu4W1K8waHyu2Um4ytvqMNVw2LW86B7SiU:zeAzW4f

Score
10/10
marsstealerdefaultdiscoverystealer

Malware Config

Extracted

Family

marsstealer

Botnet

Default

C2

www.msk-post.com/server/init.php

Signatures

  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer
  • Marsstealer family
    marsstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe
    "C:\Users\Admin\AppData\Local\Temp\b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\TORJSJ3ND.exe
      "C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\TORJSJ3ND.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1980

Network

  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.msk-post.com
    TORJSJ3ND.exe
    Remote address:
    8.8.8.8:53
    Request
    www.msk-post.com
    IN A
    Response
    www.msk-post.com
    IN A
    65.109.58.172
  • flag-fi
    GET
    http://www.msk-post.com/server/init.php
    TORJSJ3ND.exe
    Remote address:
    65.109.58.172:80
    Request
    GET /server/init.php HTTP/1.1
    Host: www.msk-post.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 301 Moved Permanently
    Server: nginx
    Date: Tue, 12 Nov 2024 10:11:04 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: keep-alive
    Location: https://www.msk-post.com:443/server/init.php
  • flag-fi
    GET
    https://www.msk-post.com/server/init.php
    TORJSJ3ND.exe
    Remote address:
    65.109.58.172:443
    Request
    GET /server/init.php HTTP/1.1
    Connection: Keep-Alive
    Cache-Control: no-cache
    Host: www.msk-post.com
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Tue, 12 Nov 2024 10:11:05 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    X-XSS-Protection: 1; mode=block
    Content-Language: ru
    X-Frame-Options: SAMEORIGIN
  • flag-fi
    GET
    https://www.msk-post.com/server/init.php
    TORJSJ3ND.exe
    Remote address:
    65.109.58.172:443
    Request
    GET /server/init.php HTTP/1.1
    Connection: Keep-Alive
    Cache-Control: no-cache
    Host: www.msk-post.com
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Tue, 12 Nov 2024 10:11:35 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    X-XSS-Protection: 1; mode=block
    Content-Language: ru
    X-Frame-Options: SAMEORIGIN
  • flag-fi
    GET
    https://www.msk-post.com/server/init.php
    TORJSJ3ND.exe
    Remote address:
    65.109.58.172:443
    Request
    GET /server/init.php HTTP/1.1
    Connection: Keep-Alive
    Cache-Control: no-cache
    Host: www.msk-post.com
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Tue, 12 Nov 2024 10:12:05 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    X-XSS-Protection: 1; mode=block
    Content-Language: ru
    X-Frame-Options: SAMEORIGIN
  • flag-fi
    GET
    https://www.msk-post.com/server/init.php
    TORJSJ3ND.exe
    Remote address:
    65.109.58.172:443
    Request
    GET /server/init.php HTTP/1.1
    Connection: Keep-Alive
    Cache-Control: no-cache
    Host: www.msk-post.com
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Tue, 12 Nov 2024 10:12:35 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    X-XSS-Protection: 1; mode=block
    Content-Language: ru
    X-Frame-Options: SAMEORIGIN
  • flag-fi
    GET
    https://www.msk-post.com/server/init.php
    TORJSJ3ND.exe
    Remote address:
    65.109.58.172:443
    Request
    GET /server/init.php HTTP/1.1
    Connection: Keep-Alive
    Cache-Control: no-cache
    Host: www.msk-post.com
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Tue, 12 Nov 2024 10:13:05 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    X-XSS-Protection: 1; mode=block
    Content-Language: ru
    X-Frame-Options: SAMEORIGIN
  • flag-us
    DNS
    r10.o.lencr.org
    TORJSJ3ND.exe
    Remote address:
    8.8.8.8:53
    Request
    r10.o.lencr.org
    IN A
    Response
    r10.o.lencr.org
    IN CNAME
    o.lencr.edgesuite.net
    o.lencr.edgesuite.net
    IN CNAME
    a1887.dscq.akamai.net
    a1887.dscq.akamai.net
    IN A
    2.23.210.75
    a1887.dscq.akamai.net
    IN A
    2.23.210.82
  • flag-gb
    GET
    http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQISyYj7EUwIXT5NSVXvSIuvg%3D%3D
    TORJSJ3ND.exe
    Remote address:
    2.23.210.75:80
    Request
    GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQISyYj7EUwIXT5NSVXvSIuvg%3D%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: r10.o.lencr.org
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Content-Type: application/ocsp-response
    Content-Length: 504
    ETag: "B5A91A80C9C40D4078638B0DC6CF71357A9670499BBF4730E3F152335E9ACB79"
    Last-Modified: Sun, 10 Nov 2024 11:32:00 UTC
    Cache-Control: public, no-transform, must-revalidate, max-age=21510
    Expires: Tue, 12 Nov 2024 16:09:35 GMT
    Date: Tue, 12 Nov 2024 10:11:05 GMT
    Connection: keep-alive
  • flag-us
    DNS
    172.58.109.65.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.58.109.65.in-addr.arpa
    IN PTR
    Response
    172.58.109.65.in-addr.arpa
    IN PTR
    static1725810965clients your-serverde
  • flag-us
    DNS
    32.169.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    32.169.19.2.in-addr.arpa
    IN PTR
    Response
    32.169.19.2.in-addr.arpa
    IN PTR
    a2-19-169-32deploystaticakamaitechnologiescom
  • flag-us
    DNS
    75.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    75.210.23.2.in-addr.arpa
    IN PTR
    Response
    75.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-75deploystaticakamaitechnologiescom
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    98.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    98.117.19.2.in-addr.arpa
    IN PTR
    Response
    98.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-98deploystaticakamaitechnologiescom
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
  • 65.109.58.172:80
    http://www.msk-post.com/server/init.php
    http
    TORJSJ3ND.exe
    336 B
     564 B
     5
    4

    HTTP Request

    GET http://www.msk-post.com/server/init.php

    HTTP Response

    301
  • 65.109.58.172:443
    https://www.msk-post.com/server/init.php
    tls, http
    TORJSJ3ND.exe
    4.7kB
     99.0kB
     83
    78

    HTTP Request

    GET https://www.msk-post.com/server/init.php

    HTTP Response

    404

    HTTP Request

    GET https://www.msk-post.com/server/init.php

    HTTP Response

    404

    HTTP Request

    GET https://www.msk-post.com/server/init.php

    HTTP Response

    404

    HTTP Request

    GET https://www.msk-post.com/server/init.php

    HTTP Response

    404

    HTTP Request

    GET https://www.msk-post.com/server/init.php

    HTTP Response

    404
  • 2.23.210.75:80
    http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQISyYj7EUwIXT5NSVXvSIuvg%3D%3D
    http
    TORJSJ3ND.exe
    568 B
     1.1kB
     7
    5

    HTTP Request

    GET http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQISyYj7EUwIXT5NSVXvSIuvg%3D%3D

    HTTP Response

    200
  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    www.msk-post.com
    dns
    TORJSJ3ND.exe
    62 B
     78 B
     1
    1

    DNS Request

    www.msk-post.com

    DNS Response

    65.109.58.172

  • 8.8.8.8:53
    r10.o.lencr.org
    dns
    TORJSJ3ND.exe
    61 B
     160 B
     1
    1

    DNS Request

    r10.o.lencr.org

    DNS Response

    2.23.210.75
    2.23.210.82

  • 8.8.8.8:53
    172.58.109.65.in-addr.arpa
    dns
    72 B
     129 B
     1
    1

    DNS Request

    172.58.109.65.in-addr.arpa

  • 8.8.8.8:53
    32.169.19.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    32.169.19.2.in-addr.arpa

  • 8.8.8.8:53
    75.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    75.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    98.117.19.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    98.117.19.2.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    14.227.111.52.in-addr.arpa

    DNS Request

    14.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\TORJSJ3ND.exe
    Filesize

    159KB

    MD5

    b13a4bddff058d6c9c44d62ecf492563

    SHA1

    dcf173cf7a9ae1c9b28c92a13bca0b619dee3511

    SHA256

    ff90f644a5d0af130cf8d61d0908447a8953d3be58c0ecd8b23f03534df30e4c

    SHA512

    7c8611fd762dbd1b77788dc0950323adf751a1a881b855c8b8cf132f4b3515479c56789b1360a028d5704426f37fb4610effb79824c0bc0ea85f2a3d7c638a90

    Download Submit

  • memory/1980-9-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

    Download

  • memory/1980-18-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

    Download

  • memory/2248-0-0x000000007483E000-0x000000007483F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2248-1-0x0000000000880000-0x00000000008F2000-memory.dmp

    Filesize

    456KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.