elysiumstealer | 4ffa12830e946bd9a968f9e3d79e7dac613d22465e72cc4492aff6d86991f73f | Triage

Analysis

max time kernel
31s
max time network
32s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 08:02

Sharing

Report Analysis Logs

General

Target

FortniteChecker.v.2.0.0/ForniteChecker.v2.0.0.exe
Size

1.8MB
MD5

6f217b137ff59fd3b821a340c0a35a4e
SHA1

1e8dc83be90e3b1c369e393032cbece7d65083b3
SHA256

9e6ebe40697a1fa68ca9208dcbe4f8349f52d288b4ced8bd2b07eec6367e025d
SHA512

bd5bde451038ba283cc8b0f459f0ef2a89ba0fcee3d6fc1cd246080a84932f1008e681cb608ee40ddc3fb35d37685c3dabf67f8a6686e8650adfba81e431e1dc

Score

10^/10

elysiumstealer evasion stealer trojan

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

resource	yara_rule
behavioral1/files/0x00090000000142ab-56.dat	elysiumstealer_dll

ElysiumStealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/1824-54-0x00000000003C0000-0x0000000000592000-memory.dmp	elysiumstealer
behavioral1/memory/1824-55-0x00000000001F0000-0x00000000001FC000-memory.dmp	elysiumstealer

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

Disabling Security Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ForniteChecker.v2.0.0.exe

Loads dropped DLL 1 IoCs

pid	Process
1824	ForniteChecker.v2.0.0.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ForniteChecker.v2.0.0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ForniteChecker.v2.0.0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

pid	Process
1072	timeout.exe

Kills process with taskkill 1 IoCs

pid	Process
908	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1824	ForniteChecker.v2.0.0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	ForniteChecker.v2.0.0.exe
Token: SeDebugPrivilege	908	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1748	1824	ForniteChecker.v2.0.0.exe	27
PID 1824 wrote to memory of 1748	1824	ForniteChecker.v2.0.0.exe	27
PID 1824 wrote to memory of 1748	1824	ForniteChecker.v2.0.0.exe	27
PID 1824 wrote to memory of 1748	1824	ForniteChecker.v2.0.0.exe	27
PID 1748 wrote to memory of 1356	1748	cmd.exe	29
PID 1748 wrote to memory of 1356	1748	cmd.exe	29
PID 1748 wrote to memory of 1356	1748	cmd.exe	29
PID 1748 wrote to memory of 1356	1748	cmd.exe	29
PID 1748 wrote to memory of 908	1748	cmd.exe	30
PID 1748 wrote to memory of 908	1748	cmd.exe	30
PID 1748 wrote to memory of 908	1748	cmd.exe	30
PID 1748 wrote to memory of 908	1748	cmd.exe	30
PID 1748 wrote to memory of 1072	1748	cmd.exe	31
PID 1748 wrote to memory of 1072	1748	cmd.exe	31
PID 1748 wrote to memory of 1072	1748	cmd.exe	31
PID 1748 wrote to memory of 1072	1748	cmd.exe	31

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ForniteChecker.v2.0.0.exe

C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp9609.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 1824
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:908
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Web Service

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9609.tmp.bat

Filesize
57B

MD5
50020e4a79b189d13818b80d87b0b1b5

SHA1
3d0fa930f254a576fd1df865f8da61c131450848

SHA256
d7ca7e17043dbd4821e97437b3e9254b6d60ad03d395e348ae1097646fbd0a57

SHA512
eabbe7229b7e414674d64e9f511292170048a4ea87d74f33890e8cdfc62cac62c35f15496491d9ced28a0c5c4bcbcbf66fca60dde51bfbce482f0a9c35667a73

Download Submit
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/1824-54-0x00000000003C0000-0x0000000000592000-memory.dmp

Filesize
1.8MB

Download
memory/1824-55-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/1824-57-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/1824-58-0x0000000004960000-0x00000000049DA000-memory.dmp

Filesize
488KB

Download