Overview

overview

10

Static

static

10

59604cfc9a...9a.exe

windows7_x64

10

59604cfc9a...9a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    92s
  • max time network
    103s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-05-2022 06:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    59604cfc9abd7621d66ded13ee63f76f06709846308bbd412f25063d42e4f79a.exe

  • Size

    440KB

  • MD5

    d3937c560d6ccd27e80a5a1749c72561

  • SHA1

    7ae5722e2f823fbb1334e244b34ef5854129fde0

  • SHA256

    59604cfc9abd7621d66ded13ee63f76f06709846308bbd412f25063d42e4f79a

  • SHA512

    76db88a01e16172599a4744fc9c68b84e323395b557d976f10ba7f488522ef39f63fb64a803bfcbac163a3ad67964cc1e6c2e58deb7fc2619de018be2e2cbdf6

Score
10/10
elysiumstealerdiscoveryspywarestealer

Malware Config

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • ElysiumStealer Payload 2 IoCs
  • ElysiumStealer Support DLL 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59604cfc9abd7621d66ded13ee63f76f06709846308bbd412f25063d42e4f79a.exe
    "C:\Users\Admin\AppData\Local\Temp\59604cfc9abd7621d66ded13ee63f76f06709846308bbd412f25063d42e4f79a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 1168
      2⤵
      • Program crash
      PID:1196

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll
    Filesize

    40KB

    MD5

    94173de2e35aa8d621fc1c4f54b2a082

    SHA1

    fbb2266ee47f88462560f0370edb329554cd5869

    SHA256

    7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

    SHA512

    cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

    Download Submit

  • memory/1196-58-0x0000000000000000-mapping.dmp

    Download

  • memory/1928-54-0x0000000000360000-0x00000000003D4000-memory.dmp

    Filesize

    464KB

    Download

  • memory/1928-55-0x0000000000200000-0x000000000020C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1928-57-0x0000000075711000-0x0000000075713000-memory.dmp

    Filesize

    8KB

    Download