elysiumstealer | 4ffa12830e946bd9a968f9e3d79e7dac613d22465e72cc4492aff6d86991f73f | Triage

Analysis

max time kernel
43s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2022 08:02

Sharing

Report Analysis Logs

General

Target

FortniteChecker.v.2.0.0/ForniteChecker.v2.0.0.exe
Size

1.8MB
MD5

6f217b137ff59fd3b821a340c0a35a4e
SHA1

1e8dc83be90e3b1c369e393032cbece7d65083b3
SHA256

9e6ebe40697a1fa68ca9208dcbe4f8349f52d288b4ced8bd2b07eec6367e025d
SHA512

bd5bde451038ba283cc8b0f459f0ef2a89ba0fcee3d6fc1cd246080a84932f1008e681cb608ee40ddc3fb35d37685c3dabf67f8a6686e8650adfba81e431e1dc

Score

10^/10

elysiumstealer evasion stealer trojan

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

ElysiumStealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/2352-130-0x0000000000BA0000-0x0000000000D72000-memory.dmp	elysiumstealer

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

Disabling Security Tools

Modify Registry

Processes:

ForniteChecker.v2.0.0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ForniteChecker.v2.0.0.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

ForniteChecker.v2.0.0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	ForniteChecker.v2.0.0.exe

Loads dropped DLL 1 IoCs

Processes:

ForniteChecker.v2.0.0.exe

pid process

2352 ForniteChecker.v2.0.0.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

Processes:

ForniteChecker.v2.0.0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ForniteChecker.v2.0.0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ForniteChecker.v2.0.0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2088 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2612 taskkill.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ForniteChecker.v2.0.0.exe

pid process

2352 ForniteChecker.v2.0.0.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ForniteChecker.v2.0.0.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 2352 ForniteChecker.v2.0.0.exe
Token: SeDebugPrivilege 2612 taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ForniteChecker.v2.0.0.execmd.exe

description	pid	process	target process
PID 2352 wrote to memory of 4808	2352	ForniteChecker.v2.0.0.exe	cmd.exe
PID 2352 wrote to memory of 4808	2352	ForniteChecker.v2.0.0.exe	cmd.exe
PID 2352 wrote to memory of 4808	2352	ForniteChecker.v2.0.0.exe	cmd.exe
PID 4808 wrote to memory of 4212	4808	cmd.exe	chcp.com
PID 4808 wrote to memory of 4212	4808	cmd.exe	chcp.com
PID 4808 wrote to memory of 4212	4808	cmd.exe	chcp.com
PID 4808 wrote to memory of 2612	4808	cmd.exe	taskkill.exe
PID 4808 wrote to memory of 2612	4808	cmd.exe	taskkill.exe
PID 4808 wrote to memory of 2612	4808	cmd.exe	taskkill.exe
PID 4808 wrote to memory of 2088	4808	cmd.exe	timeout.exe
PID 4808 wrote to memory of 2088	4808	cmd.exe	timeout.exe
PID 4808 wrote to memory of 2088	4808	cmd.exe	timeout.exe

System policy modification 1 TTPs 1 IoCs

Modify Registry

Processes:

ForniteChecker.v2.0.0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ForniteChecker.v2.0.0.exe

C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC132.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\taskkill.exe
    TaskKill /F /IM 2352
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- - C:\Windows\SysWOW64\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Web Service

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC132.tmp.bat

Filesize
57B

MD5
f0fcfd0d77c58b3964a023019fe217ac

SHA1
a1ce4f6f596901778c3fa4222809771bf901c263

SHA256
f0c1609f938b9911c4ed9859d79dfe7a3997001bb5453bc386af8dab53e7ad4c

SHA512
e1e66b8ff546eca25acf947106f11d66db408ee1445c0fef7c7d385eea82a8535147c9db650a8aa34f095022cd36b1571f9e33cb945ffc78bea6802b3d114c05

Download Submit
memory/2088-137-0x0000000000000000-mapping.dmp

Download
memory/2352-130-0x0000000000BA0000-0x0000000000D72000-memory.dmp

Filesize
1.8MB

Download
memory/2352-132-0x0000000005870000-0x00000000058D6000-memory.dmp

Filesize
408KB

Download
memory/2612-136-0x0000000000000000-mapping.dmp

Download
memory/4212-135-0x0000000000000000-mapping.dmp

Download
memory/4808-133-0x0000000000000000-mapping.dmp

Download