Overview

overview

10

Static

static

03cd951548...16.exe

windows7_x64

10

03cd951548...16.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    100s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-05-2022 12:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    03cd951548e9fd6336318f2b12e075c196e295c29a8003e67fc3c0ac77c95516.exe

  • Size

    250KB

  • MD5

    ba695ce4874a47906a47d2c5ef5d4340

  • SHA1

    bb1c06e53586de74b1921e38b10a1befd3e17747

  • SHA256

    03cd951548e9fd6336318f2b12e075c196e295c29a8003e67fc3c0ac77c95516

  • SHA512

    88d0e7e3d97439b685e7d9408f9c544ae2afb1f33cfb810bf9049eb898768d3b67ef6b1f8db6e7e77012988ec4a5d107cd42d030deecb8752fabc7b8bd4928da

Score
10/10
elysiumstealerdiscoveryspywarestealer

Malware Config

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03cd951548e9fd6336318f2b12e075c196e295c29a8003e67fc3c0ac77c95516.exe
    "C:\Users\Admin\AppData\Local\Temp\03cd951548e9fd6336318f2b12e075c196e295c29a8003e67fc3c0ac77c95516.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4328
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 1764
      2⤵
      • Program crash
      PID:1868
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4328 -ip 4328
    1⤵
      PID:364

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4328-130-0x0000000000860000-0x00000000008A6000-memory.dmp
      Filesize

      280KB

      Download
    • memory/4328-131-0x00000000081A0000-0x0000000008206000-memory.dmp
      Filesize

      408KB

      Download
    • memory/4328-132-0x00000000083F0000-0x0000000008482000-memory.dmp
      Filesize

      584KB

      Download
    • memory/4328-133-0x0000000008A40000-0x0000000008FE4000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/4328-134-0x0000000008840000-0x0000000008890000-memory.dmp
      Filesize

      320KB

      Download
    • memory/4328-135-0x0000000008930000-0x00000000089CC000-memory.dmp
      Filesize

      624KB

      Download