Overview

overview

10

Static

static

ef8010f979...57.exe

windows7-x64

10

ef8010f979...57.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2023 20:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ef8010f9799ccfe1aa10b6d850f6113835240dca7611727b0bd185994a2e8957.exe

  • Size

    5.8MB

  • MD5

    0fb52d94f12d8c6ed4e116f06016a84f

  • SHA1

    e75dc58e57e2fe0714e65675fb1c506cbc95098f

  • SHA256

    ef8010f9799ccfe1aa10b6d850f6113835240dca7611727b0bd185994a2e8957

  • SHA512

    8f83f0c90c7b30b5c8259ed3d5b5c15090257d46136d8331a115a07429d7f15bf71e202c26068f87783ce4ba7321805cfe06de8bd4185e9caf62b3ead48a28c1

  • SSDEEP

    49152:rnuZCESFabY/wd3n2AWI/9LM7vdbHJ9nltOejmnim58P2i4aQ5pTyUG6MJa3sU4W:rnQCdFaU/EZ7/CDdbrlFmim58O6aLBj

Score
10/10
elysiumstealerpersistencestealer

Malware Config

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • ElysiumStealer Support DLL 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef8010f9799ccfe1aa10b6d850f6113835240dca7611727b0bd185994a2e8957.exe
    "C:\Users\Admin\AppData\Local\Temp\ef8010f9799ccfe1aa10b6d850f6113835240dca7611727b0bd185994a2e8957.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1460
      2⤵
      • Program crash
      PID:1856
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4144 -ip 4144
    1⤵
      PID:1120

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll
      Filesize

      40KB

      MD5

      94173de2e35aa8d621fc1c4f54b2a082

      SHA1

      fbb2266ee47f88462560f0370edb329554cd5869

      SHA256

      7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

      SHA512

      cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

      Download Submit

    • memory/4144-132-0x0000000000730000-0x0000000000CF6000-memory.dmp

      Filesize

      5.8MB

      Download

    • memory/4144-134-0x0000000006230000-0x00000000067D4000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4144-135-0x0000000005C80000-0x0000000005D12000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4144-136-0x0000000005C50000-0x0000000005C5A000-memory.dmp

      Filesize

      40KB

      Download