elysiumstealer | 2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf

General

Target

2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
Size

5.8MB
MD5

e463edb483bd8f1794f48f889e36b7da
SHA1

19862ac1cfedd9ce8a2bd95e50bd077ef3f8dc17
SHA256

2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf
SHA512

8399c3680695cad096ab807344420fe794b3c0d03cda5eb6af89005c230f0bbbc252931183b1b1f3742419b02f2f5e7bcb3719523fa618c8ef0e3a103745491d
SSDEEP

98304:BUPEpCIvN4tmTITX71eurljfrAucCBaBH:CPEpZ14YTAL3rlfC

Score

10^/10

elysiumstealer persistence stealer

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

pid process

112 2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\macaddress = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe"	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2024 112 WerFault.exe 2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

pid	pid_target	process	target process
2024	112	WerFault.exe	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

pid	process
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

description pid process

Token: SeDebugPrivilege 112 2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

description	pid	process
Token: SeDebugPrivilege	112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe

description	pid	process	target process
PID 112 wrote to memory of 2024	112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe	WerFault.exe
PID 112 wrote to memory of 2024	112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe	WerFault.exe
PID 112 wrote to memory of 2024	112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe	WerFault.exe
PID 112 wrote to memory of 2024	112	2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe
"C:\Users\Admin\AppData\Local\Temp\2556a01039d21e977a4de693d52c740aaf2ced66f89ac87d3a14d49c5666aedf.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 824
  2⤵
  - Program crash
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/112-54-0x0000000000860000-0x0000000000E26000-memory.dmp

Filesize
5.8MB

Download
memory/112-55-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/112-56-0x0000000002605000-0x0000000002616000-memory.dmp

Filesize
68KB

Download
memory/112-58-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/112-60-0x0000000002605000-0x0000000002616000-memory.dmp

Filesize
68KB

Download
memory/2024-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads