Overview

overview

10

Static

static

1

VTProblem-VM (2).exe

windows7-x64

10

VTProblem-VM (2).exe

windows10-2004-x64

10

Resubmissions

19-02-2023 16:10

230219-tmlzdsfh96 10

19-02-2023 16:06

230219-tj4p2afd3z 10

19-02-2023 16:05

230219-tjjd4afh92 10

19-02-2023 16:04

230219-th18hsfd3x 10

Analysis

  • max time kernel
    241s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-ja
  • resource tags

    arch:x64arch:x86image:win7-20221111-jalocale:ja-jpos:windows7-x64systemwindows
  • submitted
    19-02-2023 16:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VTProblem-VM (2).exe

  • Size

    232KB

  • MD5

    517b49453e545a36c8f1a3bc33251cc5

  • SHA1

    e8a06fdbfbb2dc8052ede370bd977da819224a0d

  • SHA256

    48ee8d72d38ee855eafaf022a158d649d32e1b4e919e7b6f8d8b94ce47e43e98

  • SHA512

    a477ff24d032418ca17951d69cbcd77eb0d56784d96e58505077c69ead5fe0787869a756a8fb00f9c61a7aa4adb8c026acd571b6f330cae87ca020b5f498c9fe

  • SSDEEP

    6144:Iio6TsKXWMLMJsVX+J4WAQ9mhYHuOjwae9fDjxExnDE7RPiA0:IA4QWCHX+JSQ9mhYHuOjwae9fDjxExnI

Score
10/10
elysiumstealerstealer

Malware Config

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • ElysiumStealer Support DLL 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VTProblem-VM (2).exe
    "C:\Users\Admin\AppData\Local\Temp\VTProblem-VM (2).exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1532
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c "wmic cpu get Architecture, Caption, Characteristics, Description, Family, L2CacheSize, L3CacheSize, Manufacturer, Name, ProcessorId, Version&wmic baseboard get Manufacturer,Product,SerialNumber & wmic bios get BIOSVersion,Caption,CurrentLanguage,Description,Manufacturer,ReleaseDate,SerialNumber,Version & wmic CSPRODUCT get &wmic MEMORYCHIP get BankLabel,Capacity,ConfiguredClockSpeed,ConfiguredVoltage,Manufacturer,PartNumber,SerialNumber,TypeDetail,Speed & wmic DISKDRIVE get Caption,DeviceID,FirmwareRevision,Model,PNPDeviceID,SerialNumber,Size,TotalCylinders,TotalSectors,TotalTracks
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:560
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic cpu get Architecture, Caption, Characteristics, Description, Family, L2CacheSize, L3CacheSize, Manufacturer, Name, ProcessorId, Version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1656
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic baseboard get Manufacturer,Product,SerialNumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1892
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic bios get BIOSVersion,Caption,CurrentLanguage,Description,Manufacturer,ReleaseDate,SerialNumber,Version
        3⤵
          PID:1904
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic CSPRODUCT get
          3⤵
            PID:836
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic MEMORYCHIP get BankLabel,Capacity,ConfiguredClockSpeed,ConfiguredVoltage,Manufacturer,PartNumber,SerialNumber,TypeDetail,Speed
            3⤵
              PID:516
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic DISKDRIVE get Caption,DeviceID,FirmwareRevision,Model,PNPDeviceID,SerialNumber,Size,TotalCylinders,TotalSectors,TotalTracks
              3⤵
                PID:1828
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c "tasklist
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:452
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                3⤵
                • Enumerates processes with tasklist
                PID:1832

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • \Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\0x7RT.dll
            Filesize

            40KB

            MD5

            94173de2e35aa8d621fc1c4f54b2a082

            SHA1

            fbb2266ee47f88462560f0370edb329554cd5869

            SHA256

            7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

            SHA512

            cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

            Download Submit

          • memory/1752-54-0x0000000000A70000-0x0000000000AB0000-memory.dmp

            Filesize

            256KB

            Download

          • memory/1752-56-0x0000000000300000-0x0000000000314000-memory.dmp

            Filesize

            80KB

            Download

          • memory/1752-55-0x0000000076601000-0x0000000076603000-memory.dmp

            Filesize

            8KB

            Download