elysiumstealer | aa84a2b5ded695ac4c3ab79db699f923326f090559d255894beb2622ea7747a2

Analysis

max time kernel
50s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2022 00:54

Target

HwidSpoofer.exe
Size

6.8MB
MD5

ac41f53c98d2727078abc6d63c0a3806
SHA1

f91c057d9543a06fcb6eab16aaa7f2da94f7dc32
SHA256

aa84a2b5ded695ac4c3ab79db699f923326f090559d255894beb2622ea7747a2
SHA512

f97f5157b72776fa75ef15abff3f640b773da4ea01e39b6826c89dfc20c504d0d5304cdaf590ffbc3004364d4cdc7db1ac29521d9a36244fc4fd37e52ed14a6c
SSDEEP

196608:1SLbXf4rrjqLbXf4rrjqLbXf4rrjqLbXf4rrjqLbXf4rrjqLbXf4rrjY7fC++UZ:14TQPkTQPkTQPkTQPkTQPkTQPB++W

Score

10^/10

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

HwidSpoofer.exe

pid process

2144 HwidSpoofer.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2584 2144 WerFault.exe HwidSpoofer.exe

pid	process
2144	HwidSpoofer.exe

pid	pid_target	process	target process
2584	2144	WerFault.exe	HwidSpoofer.exe

C:\Users\Admin\AppData\Local\Temp\HwidSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\HwidSpoofer.exe"
1⤵
- Loads dropped DLL
PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 1076
  2⤵
  - Program crash
  PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2144 -ip 2144
1⤵
PID:4772

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/2144-132-0x0000000000140000-0x0000000000814000-memory.dmp

Filesize
6.8MB

Download
memory/2144-134-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/2144-135-0x00000000052E0000-0x0000000005372000-memory.dmp

Filesize
584KB

Download
memory/2144-136-0x0000000005280000-0x000000000528A000-memory.dmp

Filesize
40KB

Download