Analysis

  • max time kernel
    83s
  • max time network
    160s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    13/09/2021, 11:19

General

  • Target

    cb129cd67225cb40c544eab07466be9305132fc9607214174b48f4167e0b6b3d.exe

  • Size

    78KB

  • MD5

    a8db62010fc3ff8a86abdf3988646a8c

  • SHA1

    247577574d8f60a064b03d9f2a627d0bdbc6d2a6

  • SHA256

    cb129cd67225cb40c544eab07466be9305132fc9607214174b48f4167e0b6b3d

  • SHA512

    8234d169c809f91658f88ccb80be1dbae587ff9e0a3e517f4b42ac0f2e4a3be73b77bba787b6ebc55422c2f081b9c07e44f1192d63c90d3837b55597f68b0e1d

Malware Config

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb129cd67225cb40c544eab07466be9305132fc9607214174b48f4167e0b6b3d.exe
    "C:\Users\Admin\AppData\Local\Temp\cb129cd67225cb40c544eab07466be9305132fc9607214174b48f4167e0b6b3d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3944
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 2120
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2644

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3944-117-0x0000000000340000-0x0000000000341000-memory.dmp

    Filesize

    4KB

  • memory/3944-119-0x0000000000CE0000-0x0000000000CFB000-memory.dmp

    Filesize

    108KB

  • memory/3944-120-0x0000000004B60000-0x0000000004B61000-memory.dmp

    Filesize

    4KB

  • memory/3944-121-0x0000000007B80000-0x0000000007B81000-memory.dmp

    Filesize

    4KB

  • memory/3944-122-0x0000000007ED0000-0x0000000007ED1000-memory.dmp

    Filesize

    4KB

  • memory/3944-123-0x0000000008470000-0x0000000008471000-memory.dmp

    Filesize

    4KB

  • memory/3944-124-0x0000000008210000-0x0000000008211000-memory.dmp

    Filesize

    4KB