Analysis
-
max time kernel
69s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
09-12-2022 02:30
General
-
Target
Smelo Woofer/HwidSpoofer.exe
-
Size
6.8MB
-
MD5
ac41f53c98d2727078abc6d63c0a3806
-
SHA1
f91c057d9543a06fcb6eab16aaa7f2da94f7dc32
-
SHA256
aa84a2b5ded695ac4c3ab79db699f923326f090559d255894beb2622ea7747a2
-
SHA512
f97f5157b72776fa75ef15abff3f640b773da4ea01e39b6826c89dfc20c504d0d5304cdaf590ffbc3004364d4cdc7db1ac29521d9a36244fc4fd37e52ed14a6c
-
SSDEEP
196608:1SLbXf4rrjqLbXf4rrjqLbXf4rrjqLbXf4rrjqLbXf4rrjqLbXf4rrjY7fC++UZ:14TQPkTQPkTQPkTQPkTQPkTQPB++W
Malware Config
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Support DLL 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
Filesize
40KB
MD594173de2e35aa8d621fc1c4f54b2a082
SHA1fbb2266ee47f88462560f0370edb329554cd5869
SHA2567e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798
-
Filesize
6.8MB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
408KB
-
Filesize
68KB
-
Filesize
2.2MB