elysiumstealer | aa84a2b5ded695ac4c3ab79db699f923326f090559d255894beb2622ea7747a2

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-12-2022 00:54

Target

HwidSpoofer.exe
Size

6.8MB
MD5

ac41f53c98d2727078abc6d63c0a3806
SHA1

f91c057d9543a06fcb6eab16aaa7f2da94f7dc32
SHA256

aa84a2b5ded695ac4c3ab79db699f923326f090559d255894beb2622ea7747a2
SHA512

f97f5157b72776fa75ef15abff3f640b773da4ea01e39b6826c89dfc20c504d0d5304cdaf590ffbc3004364d4cdc7db1ac29521d9a36244fc4fd37e52ed14a6c
SSDEEP

196608:1SLbXf4rrjqLbXf4rrjqLbXf4rrjqLbXf4rrjqLbXf4rrjqLbXf4rrjY7fC++UZ:14TQPkTQPkTQPkTQPkTQPkTQPB++W

Score

10^/10

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

HwidSpoofer.exe

pid process

1672 HwidSpoofer.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1520 1672 WerFault.exe HwidSpoofer.exe

pid	process
1672	HwidSpoofer.exe

pid	pid_target	process	target process
1520	1672	WerFault.exe	HwidSpoofer.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

HwidSpoofer.exe

description	pid	process	target process
PID 1672 wrote to memory of 1520	1672	HwidSpoofer.exe	WerFault.exe
PID 1672 wrote to memory of 1520	1672	HwidSpoofer.exe	WerFault.exe
PID 1672 wrote to memory of 1520	1672	HwidSpoofer.exe	WerFault.exe
PID 1672 wrote to memory of 1520	1672	HwidSpoofer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\HwidSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\HwidSpoofer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 640
  2⤵
  - Program crash
  PID:1520

\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/1520-58-0x0000000000000000-mapping.dmp

Download
memory/1672-54-0x0000000000990000-0x0000000001064000-memory.dmp

Filesize
6.8MB

Download
memory/1672-55-0x00000000001E0000-0x00000000001EC000-memory.dmp

Filesize
48KB

Download
memory/1672-57-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download