elysiumstealer | 4ffa12830e946bd9a968f9e3d79e7dac613d22465e72cc4492aff6d86991f73f | Triage

Analysis

max time kernel
31s
max time network
32s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 08:02

Sharing

Report Analysis Logs

General

Target

FortniteChecker.v.2.0.0/ForniteChecker.v2.0.0.exe
Size

1.8MB
MD5

6f217b137ff59fd3b821a340c0a35a4e
SHA1

1e8dc83be90e3b1c369e393032cbece7d65083b3
SHA256

9e6ebe40697a1fa68ca9208dcbe4f8349f52d288b4ced8bd2b07eec6367e025d
SHA512

bd5bde451038ba283cc8b0f459f0ef2a89ba0fcee3d6fc1cd246080a84932f1008e681cb608ee40ddc3fb35d37685c3dabf67f8a6686e8650adfba81e431e1dc

Score

10^/10

elysiumstealer evasion stealer trojan

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

ElysiumStealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1824-54-0x00000000003C0000-0x0000000000592000-memory.dmp	elysiumstealer
behavioral1/memory/1824-55-0x00000000001F0000-0x00000000001FC000-memory.dmp	elysiumstealer

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

Disabling Security Tools

Modify Registry

Processes:

ForniteChecker.v2.0.0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ForniteChecker.v2.0.0.exe

Loads dropped DLL 1 IoCs

Processes:

ForniteChecker.v2.0.0.exe

pid process

1824 ForniteChecker.v2.0.0.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

Processes:

ForniteChecker.v2.0.0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ForniteChecker.v2.0.0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ForniteChecker.v2.0.0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1072 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

908 taskkill.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ForniteChecker.v2.0.0.exe

pid process

1824 ForniteChecker.v2.0.0.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ForniteChecker.v2.0.0.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 1824 ForniteChecker.v2.0.0.exe
Token: SeDebugPrivilege 908 taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

ForniteChecker.v2.0.0.execmd.exe

description	pid	process	target process
PID 1824 wrote to memory of 1748	1824	ForniteChecker.v2.0.0.exe	cmd.exe
PID 1824 wrote to memory of 1748	1824	ForniteChecker.v2.0.0.exe	cmd.exe
PID 1824 wrote to memory of 1748	1824	ForniteChecker.v2.0.0.exe	cmd.exe
PID 1824 wrote to memory of 1748	1824	ForniteChecker.v2.0.0.exe	cmd.exe
PID 1748 wrote to memory of 1356	1748	cmd.exe	chcp.com
PID 1748 wrote to memory of 1356	1748	cmd.exe	chcp.com
PID 1748 wrote to memory of 1356	1748	cmd.exe	chcp.com
PID 1748 wrote to memory of 1356	1748	cmd.exe	chcp.com
PID 1748 wrote to memory of 908	1748	cmd.exe	taskkill.exe
PID 1748 wrote to memory of 908	1748	cmd.exe	taskkill.exe
PID 1748 wrote to memory of 908	1748	cmd.exe	taskkill.exe
PID 1748 wrote to memory of 908	1748	cmd.exe	taskkill.exe
PID 1748 wrote to memory of 1072	1748	cmd.exe	timeout.exe
PID 1748 wrote to memory of 1072	1748	cmd.exe	timeout.exe
PID 1748 wrote to memory of 1072	1748	cmd.exe	timeout.exe
PID 1748 wrote to memory of 1072	1748	cmd.exe	timeout.exe

System policy modification 1 TTPs 1 IoCs

Modify Registry

Processes:

ForniteChecker.v2.0.0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ForniteChecker.v2.0.0.exe

C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp9609.tmp.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:1356

C:\Windows\SysWOW64\taskkill.exe
TaskKill /F /IM 1824
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\SysWOW64\timeout.exe
Timeout /T 2 /Nobreak
3⤵
- Delays execution with timeout.exe
PID:1072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9609.tmp.bat
Filesize
57B

MD5
50020e4a79b189d13818b80d87b0b1b5

SHA1
3d0fa930f254a576fd1df865f8da61c131450848

SHA256
d7ca7e17043dbd4821e97437b3e9254b6d60ad03d395e348ae1097646fbd0a57

SHA512
eabbe7229b7e414674d64e9f511292170048a4ea87d74f33890e8cdfc62cac62c35f15496491d9ced28a0c5c4bcbcbf66fca60dde51bfbce482f0a9c35667a73

Download Submit
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll
Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/908-62-0x0000000000000000-mapping.dmp

Download
memory/1072-63-0x0000000000000000-mapping.dmp

Download
memory/1356-61-0x0000000000000000-mapping.dmp

Download
memory/1748-59-0x0000000000000000-mapping.dmp

Download
memory/1824-54-0x00000000003C0000-0x0000000000592000-memory.dmp

Filesize
1.8MB

Download
memory/1824-55-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/1824-57-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/1824-58-0x0000000004960000-0x00000000049DA000-memory.dmp

Filesize
488KB

Download