Analysis Overview
SHA256
575efdf9c390ca124feddcd864a095c2e9a9bf8d2108989f9587472cc992133d
Threat Level: Known bad
The file fe.exe was found to be: Known bad.
Malicious Activity Summary
ElysiumStealer
ElysiumStealer Support DLL
Loads dropped DLL
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2022-12-19 09:10
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-12-19 09:10
Reported
2022-12-19 09:10
Platform
win7-20220812-en
Max time kernel
3s
Command Line
Signatures
ElysiumStealer
ElysiumStealer Support DLL
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\fe.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\fe.exe
"C:\Users\Admin\AppData\Local\Temp\fe.exe"
Network
Files
memory/1184-54-0x0000000001260000-0x00000000012DC000-memory.dmp
memory/1184-55-0x0000000000290000-0x000000000029C000-memory.dmp
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll
| MD5 | 94173de2e35aa8d621fc1c4f54b2a082 |
| SHA1 | fbb2266ee47f88462560f0370edb329554cd5869 |
| SHA256 | 7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f |
| SHA512 | cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798 |
memory/1184-57-0x0000000074BB1000-0x0000000074BB3000-memory.dmp
memory/1184-58-0x0000000000580000-0x0000000000588000-memory.dmp
memory/1184-59-0x00000000007C0000-0x00000000007C8000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-12-19 09:10
Reported
2022-12-19 09:10
Platform
win10v2004-20220812-en
Max time kernel
15s
Max time network
13s
Command Line
Signatures
ElysiumStealer
ElysiumStealer Support DLL
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\fe.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\fe.exe
"C:\Users\Admin\AppData\Local\Temp\fe.exe"
Network
Files
memory/2088-132-0x0000000000730000-0x00000000007AC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll
| MD5 | 94173de2e35aa8d621fc1c4f54b2a082 |
| SHA1 | fbb2266ee47f88462560f0370edb329554cd5869 |
| SHA256 | 7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f |
| SHA512 | cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798 |
memory/2088-134-0x00000000050D0000-0x0000000005162000-memory.dmp
memory/2088-135-0x0000000005030000-0x0000000005038000-memory.dmp