elysiumstealer | 048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e

General

Target

048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe
Size

214KB
MD5

a410e22ecff109bf25e0118dba09ee7b
SHA1

10c578febb10ac73d4a75b5a8b5b1e083d5ba4f7
SHA256

048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e
SHA512

d30b733b0206911d22aa5a8e398161f5b709426d2e25c310a19ee51f24eb401730e297826af47508578026582e294826c34328749617c6e7f39387ad86bf524d

Score

10^/10

elysiumstealer discovery spyware stealer

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
932	1664	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exeWerFault.exe

pid	Process
1664	048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe
932	WerFault.exe
932	WerFault.exe
932	WerFault.exe
932	WerFault.exe
932	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid	Process
932	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exeWerFault.exe

description	pid	Process
Token: SeDebugPrivilege	1664	048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe
Token: SeDebugPrivilege	932	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe

description	pid	Process	procid_target
PID 1664 wrote to memory of 932	1664	048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe	31
PID 1664 wrote to memory of 932	1664	048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe	31
PID 1664 wrote to memory of 932	1664	048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe	31
PID 1664 wrote to memory of 932	1664	048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe	31

C:\Users\Admin\AppData\Local\Temp\048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe
"C:\Users\Admin\AppData\Local\Temp\048aeb6018e2d3c911263241570bb49c309d0d5d34dd91de49327bf60711674e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 1928
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-59-0x0000000000000000-mapping.dmp

Download
memory/932-60-0x00000000003F0000-0x000000000042C000-memory.dmp

Filesize
240KB

Download
memory/1664-53-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/1664-55-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1664-56-0x0000000000450000-0x000000000047E000-memory.dmp

Filesize
184KB

Download
memory/1664-57-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1664-58-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads