elysiumstealer | 48ee8d72d38ee855eafaf022a158d649d32e1b4e919e7b6f8d8b94ce47e43e98

General

Target

VTProblem-VM (2).exe
Size

232KB
MD5

517b49453e545a36c8f1a3bc33251cc5
SHA1

e8a06fdbfbb2dc8052ede370bd977da819224a0d
SHA256

48ee8d72d38ee855eafaf022a158d649d32e1b4e919e7b6f8d8b94ce47e43e98
SHA512

a477ff24d032418ca17951d69cbcd77eb0d56784d96e58505077c69ead5fe0787869a756a8fb00f9c61a7aa4adb8c026acd571b6f330cae87ca020b5f498c9fe
SSDEEP

6144:Iio6TsKXWMLMJsVX+J4WAQ9mhYHuOjwae9fDjxExnDE7RPiA0:IA4QWCHX+JSQ9mhYHuOjwae9fDjxExnI

Score

10^/10

elysiumstealer stealer

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\0x7RT.dll	elysiumstealer_dll

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

VTProblem-VM (2).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	VTProblem-VM (2).exe

Loads dropped DLL 1 IoCs

Processes:

VTProblem-VM (2).exe

pid process

4308 VTProblem-VM (2).exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2500 tasklist.exe

pid	process
2500	tasklist.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

VTProblem-VM (2).exeTaskmgr.exe

pid	process
4308	VTProblem-VM (2).exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

VTProblem-VM (2).exeWMIC.exeTaskmgr.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4308	VTProblem-VM (2).exe
Token: SeIncreaseQuotaPrivilege	632	WMIC.exe
Token: SeSecurityPrivilege	632	WMIC.exe
Token: SeTakeOwnershipPrivilege	632	WMIC.exe
Token: SeLoadDriverPrivilege	632	WMIC.exe
Token: SeSystemProfilePrivilege	632	WMIC.exe
Token: SeSystemtimePrivilege	632	WMIC.exe
Token: SeProfSingleProcessPrivilege	632	WMIC.exe
Token: SeIncBasePriorityPrivilege	632	WMIC.exe
Token: SeCreatePagefilePrivilege	632	WMIC.exe
Token: SeBackupPrivilege	632	WMIC.exe
Token: SeRestorePrivilege	632	WMIC.exe
Token: SeShutdownPrivilege	632	WMIC.exe
Token: SeDebugPrivilege	632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	632	WMIC.exe
Token: SeRemoteShutdownPrivilege	632	WMIC.exe
Token: SeUndockPrivilege	632	WMIC.exe
Token: SeManageVolumePrivilege	632	WMIC.exe
Token: 33	632	WMIC.exe
Token: 34	632	WMIC.exe
Token: 35	632	WMIC.exe
Token: 36	632	WMIC.exe
Token: SeDebugPrivilege	4832	Taskmgr.exe
Token: SeSystemProfilePrivilege	4832	Taskmgr.exe
Token: SeCreateGlobalPrivilege	4832	Taskmgr.exe
Token: SeIncreaseQuotaPrivilege	632	WMIC.exe
Token: SeSecurityPrivilege	632	WMIC.exe
Token: SeTakeOwnershipPrivilege	632	WMIC.exe
Token: SeLoadDriverPrivilege	632	WMIC.exe
Token: SeSystemProfilePrivilege	632	WMIC.exe
Token: SeSystemtimePrivilege	632	WMIC.exe
Token: SeProfSingleProcessPrivilege	632	WMIC.exe
Token: SeIncBasePriorityPrivilege	632	WMIC.exe
Token: SeCreatePagefilePrivilege	632	WMIC.exe
Token: SeBackupPrivilege	632	WMIC.exe
Token: SeRestorePrivilege	632	WMIC.exe
Token: SeShutdownPrivilege	632	WMIC.exe
Token: SeDebugPrivilege	632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	632	WMIC.exe
Token: SeRemoteShutdownPrivilege	632	WMIC.exe
Token: SeUndockPrivilege	632	WMIC.exe
Token: SeManageVolumePrivilege	632	WMIC.exe
Token: 33	632	WMIC.exe
Token: 34	632	WMIC.exe
Token: 35	632	WMIC.exe
Token: 36	632	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5072	WMIC.exe
Token: SeSecurityPrivilege	5072	WMIC.exe
Token: SeTakeOwnershipPrivilege	5072	WMIC.exe
Token: SeLoadDriverPrivilege	5072	WMIC.exe
Token: SeSystemProfilePrivilege	5072	WMIC.exe
Token: SeSystemtimePrivilege	5072	WMIC.exe
Token: SeProfSingleProcessPrivilege	5072	WMIC.exe
Token: SeIncBasePriorityPrivilege	5072	WMIC.exe
Token: SeCreatePagefilePrivilege	5072	WMIC.exe
Token: SeBackupPrivilege	5072	WMIC.exe
Token: SeRestorePrivilege	5072	WMIC.exe
Token: SeShutdownPrivilege	5072	WMIC.exe
Token: SeDebugPrivilege	5072	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5072	WMIC.exe
Token: SeRemoteShutdownPrivilege	5072	WMIC.exe
Token: SeUndockPrivilege	5072	WMIC.exe
Token: SeManageVolumePrivilege	5072	WMIC.exe
Token: 33	5072	WMIC.exe

Suspicious use of FindShellTrayWindow 37 IoCs

Processes:

Taskmgr.exe

pid	process
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe

Suspicious use of SendNotifyMessage 37 IoCs

Processes:

Taskmgr.exe

pid	process
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe
4832	Taskmgr.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

VTProblem-VM (2).execmd.execmd.exe

description	pid	process	target process
PID 4308 wrote to memory of 4832	4308	VTProblem-VM (2).exe	Taskmgr.exe
PID 4308 wrote to memory of 4832	4308	VTProblem-VM (2).exe	Taskmgr.exe
PID 4308 wrote to memory of 4832	4308	VTProblem-VM (2).exe	Taskmgr.exe
PID 4308 wrote to memory of 4876	4308	VTProblem-VM (2).exe	cmd.exe
PID 4308 wrote to memory of 4876	4308	VTProblem-VM (2).exe	cmd.exe
PID 4308 wrote to memory of 4876	4308	VTProblem-VM (2).exe	cmd.exe
PID 4876 wrote to memory of 632	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 632	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 632	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 5072	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 5072	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 5072	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 4788	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 4788	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 4788	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 2976	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 2976	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 2976	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 2084	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 2084	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 2084	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 5032	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 5032	4876	cmd.exe	WMIC.exe
PID 4876 wrote to memory of 5032	4876	cmd.exe	WMIC.exe
PID 4308 wrote to memory of 1380	4308	VTProblem-VM (2).exe	cmd.exe
PID 4308 wrote to memory of 1380	4308	VTProblem-VM (2).exe	cmd.exe
PID 4308 wrote to memory of 1380	4308	VTProblem-VM (2).exe	cmd.exe
PID 1380 wrote to memory of 2500	1380	cmd.exe	tasklist.exe
PID 1380 wrote to memory of 2500	1380	cmd.exe	tasklist.exe
PID 1380 wrote to memory of 2500	1380	cmd.exe	tasklist.exe

C:\Users\Admin\AppData\Local\Temp\VTProblem-VM (2).exe
"C:\Users\Admin\AppData\Local\Temp\VTProblem-VM (2).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c "wmic cpu get Architecture, Caption, Characteristics, Description, Family, L2CacheSize, L3CacheSize, Manufacturer, Name, ProcessorId, Version&wmic baseboard get Manufacturer,Product,SerialNumber & wmic bios get BIOSVersion,Caption,CurrentLanguage,Description,Manufacturer,ReleaseDate,SerialNumber,Version & wmic CSPRODUCT get &wmic MEMORYCHIP get BankLabel,Capacity,ConfiguredClockSpeed,ConfiguredVoltage,Manufacturer,PartNumber,SerialNumber,TypeDetail,Speed & wmic DISKDRIVE get Caption,DeviceID,FirmwareRevision,Model,PNPDeviceID,SerialNumber,Size,TotalCylinders,TotalSectors,TotalTracks
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get Architecture, Caption, Characteristics, Description, Family, L2CacheSize, L3CacheSize, Manufacturer, Name, ProcessorId, Version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:632
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic baseboard get Manufacturer,Product,SerialNumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic bios get BIOSVersion,Caption,CurrentLanguage,Description,Manufacturer,ReleaseDate,SerialNumber,Version
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic CSPRODUCT get
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic MEMORYCHIP get BankLabel,Capacity,ConfiguredClockSpeed,ConfiguredVoltage,Manufacturer,PartNumber,SerialNumber,TypeDetail,Speed
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic DISKDRIVE get Caption,DeviceID,FirmwareRevision,Model,PNPDeviceID,SerialNumber,Size,TotalCylinders,TotalSectors,TotalTracks
    3⤵
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c "tasklist
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\0x7RT.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/632-137-0x0000000000000000-mapping.dmp

Download
memory/1380-143-0x0000000000000000-mapping.dmp

Download
memory/2084-141-0x0000000000000000-mapping.dmp

Download
memory/2500-144-0x0000000000000000-mapping.dmp

Download
memory/2976-140-0x0000000000000000-mapping.dmp

Download
memory/4308-133-0x0000000005B80000-0x0000000006124000-memory.dmp

Filesize
5.6MB

Download
memory/4308-132-0x0000000000B10000-0x0000000000B50000-memory.dmp

Filesize
256KB

Download
memory/4308-145-0x0000000006590000-0x0000000006622000-memory.dmp

Filesize
584KB

Download
memory/4788-139-0x0000000000000000-mapping.dmp

Download
memory/4832-135-0x0000000000000000-mapping.dmp

Download
memory/4876-136-0x0000000000000000-mapping.dmp

Download
memory/5032-142-0x0000000000000000-mapping.dmp

Download
memory/5072-138-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads