Analysis
-
max time kernel
111s -
max time network
21s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
17-07-2021 01:56
General
-
Target
AntiPublic.exe
-
Size
449KB
-
MD5
b3102c8ff03714b22e9408fcf3d63ade
-
SHA1
22da268e12c894698d4cf7cd6c4f69762ff68c4a
-
SHA256
fd492b317c4004ce5046da22cbd0f14a698dec548eff87eee4f062284bf41505
-
SHA512
f8231bc2b6a81861a6890416568bdb7e0268c01b5083c5f6990abf66cf7f3109a6e5e72e011374d43cec0951f10521e6384fb6a4a3c22e012515a535b593e144
Score
10/10
Malware Config
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Payload 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AntiPublic.exe"C:\Users\Admin\AppData\Local\Temp\AntiPublic.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 772 -s 5962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB