elysiumstealer | 33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744

Analysis

max time kernel
61s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2022 11:38

Target

33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744.bin.exe
Size

496KB
MD5

49a7d1726e99dfbe948ddb72208a7c6f
SHA1

0d16e1ca6381ab2735a63d153936f30048f02f13
SHA256

33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744
SHA512

4ff4c0a221b3d7a1b3dc593cd563ee05a84280373bbc4671928fc801bf6fa71f7dec77c09b3032d302739878eae57e2a5b87db215a4b30d3f570151e4c3ed2fd
SSDEEP

6144:cGwX2ZQvopOYQ42NcWR3Xwlb7X9rx12GValheKrRKLLMJs4+dbyuE:cGwgQVYUWWhMftxLA8/

Score

10^/10

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4908-132-0x0000000000C40000-0x0000000000CC2000-memory.dmp	elysiumstealer

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\EnterConnect.png.MafiaWare666	33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744.bin.exe
File opened for modification	C:\Users\Admin\Pictures\RepairClose.png.MafiaWare666	33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744.bin.exe
File opened for modification	C:\Users\Admin\Pictures\LockWatch.raw.MafiaWare666	33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744.bin.exe
File opened for modification	C:\Users\Admin\Pictures\MergeConnect.crw.MafiaWare666	33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744.bin.exe

Loads dropped DLL 1 IoCs

pid	Process
4908	33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744.bin.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1816	4908	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744.bin.exe
"C:\Users\Admin\AppData\Local\Temp\33e58ab07de493ea0bc34ef7ec2c7430d6af0f222e378b6c628fdef6c920c744.bin.exe"
1⤵
- Modifies extensions of user files
- Loads dropped DLL
PID:4908
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4908 -s 1148
  2⤵
  - Program crash
  PID:1816

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4908 -ip 4908
1⤵
PID:3412

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
39KB

MD5
d80d1b6d9a6d5986fa47f6f8487030e1

SHA1
8f5773bf9eca43b079c1766b2e9f44cc90bd9215

SHA256
446128f1712da8064d0197376184315cb529ed26ed9122f7b171bb208e22c0c3

SHA512
9fcf0105c2c9ee81c526d41633d93579bb8e2837989d77fb4a6523440415ec2d7fa46ac9ae4e55ecebd99126837817ac308cc079475de02667b21727a43d74cc

Download Submit
memory/4908-132-0x0000000000C40000-0x0000000000CC2000-memory.dmp

Filesize
520KB

Download
memory/4908-134-0x00007FFBFE880000-0x00007FFBFF341000-memory.dmp

Filesize
10.8MB

Download
memory/4908-135-0x00007FFBFE880000-0x00007FFBFF341000-memory.dmp

Filesize
10.8MB

Download
memory/4908-136-0x00007FFBFE880000-0x00007FFBFF341000-memory.dmp

Filesize
10.8MB

Download