elysiumstealer | 48ee8d72d38ee855eafaf022a158d649d32e1b4e919e7b6f8d8b94ce47e43e98

General

Target

VTProblem-VM (2).exe
Size

232KB
MD5

517b49453e545a36c8f1a3bc33251cc5
SHA1

e8a06fdbfbb2dc8052ede370bd977da819224a0d
SHA256

48ee8d72d38ee855eafaf022a158d649d32e1b4e919e7b6f8d8b94ce47e43e98
SHA512

a477ff24d032418ca17951d69cbcd77eb0d56784d96e58505077c69ead5fe0787869a756a8fb00f9c61a7aa4adb8c026acd571b6f330cae87ca020b5f498c9fe
SSDEEP

6144:Iio6TsKXWMLMJsVX+J4WAQ9mhYHuOjwae9fDjxExnDE7RPiA0:IA4QWCHX+JSQ9mhYHuOjwae9fDjxExnI

Score

10^/10

elysiumstealer stealer

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\0x7RT.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

VTProblem-VM (2).exe

pid process

1124 VTProblem-VM (2).exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

1140 tasklist.exe

pid	process
1140	tasklist.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

VTProblem-VM (2).exetaskmgr.exe

pid	process
1124	VTProblem-VM (2).exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

VTProblem-VM (2).exetaskmgr.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1124	VTProblem-VM (2).exe
Token: SeDebugPrivilege	2020	taskmgr.exe
Token: SeIncreaseQuotaPrivilege	2008	WMIC.exe
Token: SeSecurityPrivilege	2008	WMIC.exe
Token: SeTakeOwnershipPrivilege	2008	WMIC.exe
Token: SeLoadDriverPrivilege	2008	WMIC.exe
Token: SeSystemProfilePrivilege	2008	WMIC.exe
Token: SeSystemtimePrivilege	2008	WMIC.exe
Token: SeProfSingleProcessPrivilege	2008	WMIC.exe
Token: SeIncBasePriorityPrivilege	2008	WMIC.exe
Token: SeCreatePagefilePrivilege	2008	WMIC.exe
Token: SeBackupPrivilege	2008	WMIC.exe
Token: SeRestorePrivilege	2008	WMIC.exe
Token: SeShutdownPrivilege	2008	WMIC.exe
Token: SeDebugPrivilege	2008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2008	WMIC.exe
Token: SeRemoteShutdownPrivilege	2008	WMIC.exe
Token: SeUndockPrivilege	2008	WMIC.exe
Token: SeManageVolumePrivilege	2008	WMIC.exe
Token: 33	2008	WMIC.exe
Token: 34	2008	WMIC.exe
Token: 35	2008	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2008	WMIC.exe
Token: SeSecurityPrivilege	2008	WMIC.exe
Token: SeTakeOwnershipPrivilege	2008	WMIC.exe
Token: SeLoadDriverPrivilege	2008	WMIC.exe
Token: SeSystemProfilePrivilege	2008	WMIC.exe
Token: SeSystemtimePrivilege	2008	WMIC.exe
Token: SeProfSingleProcessPrivilege	2008	WMIC.exe
Token: SeIncBasePriorityPrivilege	2008	WMIC.exe
Token: SeCreatePagefilePrivilege	2008	WMIC.exe
Token: SeBackupPrivilege	2008	WMIC.exe
Token: SeRestorePrivilege	2008	WMIC.exe
Token: SeShutdownPrivilege	2008	WMIC.exe
Token: SeDebugPrivilege	2008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2008	WMIC.exe
Token: SeRemoteShutdownPrivilege	2008	WMIC.exe
Token: SeUndockPrivilege	2008	WMIC.exe
Token: SeManageVolumePrivilege	2008	WMIC.exe
Token: 33	2008	WMIC.exe
Token: 34	2008	WMIC.exe
Token: 35	2008	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1936	WMIC.exe
Token: SeSecurityPrivilege	1936	WMIC.exe
Token: SeTakeOwnershipPrivilege	1936	WMIC.exe
Token: SeLoadDriverPrivilege	1936	WMIC.exe
Token: SeSystemProfilePrivilege	1936	WMIC.exe
Token: SeSystemtimePrivilege	1936	WMIC.exe
Token: SeProfSingleProcessPrivilege	1936	WMIC.exe
Token: SeIncBasePriorityPrivilege	1936	WMIC.exe
Token: SeCreatePagefilePrivilege	1936	WMIC.exe
Token: SeBackupPrivilege	1936	WMIC.exe
Token: SeRestorePrivilege	1936	WMIC.exe
Token: SeShutdownPrivilege	1936	WMIC.exe
Token: SeDebugPrivilege	1936	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1936	WMIC.exe
Token: SeRemoteShutdownPrivilege	1936	WMIC.exe
Token: SeUndockPrivilege	1936	WMIC.exe
Token: SeManageVolumePrivilege	1936	WMIC.exe
Token: 33	1936	WMIC.exe
Token: 34	1936	WMIC.exe
Token: 35	1936	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1936	WMIC.exe
Token: SeSecurityPrivilege	1936	WMIC.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

taskmgr.exe

pid	process
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

taskmgr.exe

pid	process
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe
2020	taskmgr.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

VTProblem-VM (2).execmd.execmd.exe

description	pid	process	target process
PID 1124 wrote to memory of 2020	1124	VTProblem-VM (2).exe	taskmgr.exe
PID 1124 wrote to memory of 2020	1124	VTProblem-VM (2).exe	taskmgr.exe
PID 1124 wrote to memory of 2020	1124	VTProblem-VM (2).exe	taskmgr.exe
PID 1124 wrote to memory of 2020	1124	VTProblem-VM (2).exe	taskmgr.exe
PID 1124 wrote to memory of 1792	1124	VTProblem-VM (2).exe	cmd.exe
PID 1124 wrote to memory of 1792	1124	VTProblem-VM (2).exe	cmd.exe
PID 1124 wrote to memory of 1792	1124	VTProblem-VM (2).exe	cmd.exe
PID 1124 wrote to memory of 1792	1124	VTProblem-VM (2).exe	cmd.exe
PID 1792 wrote to memory of 2008	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 2008	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 2008	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 2008	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1936	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1936	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1936	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1936	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1064	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1064	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1064	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1064	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1544	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1544	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1544	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1544	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1652	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1652	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1652	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1652	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1088	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1088	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1088	1792	cmd.exe	WMIC.exe
PID 1792 wrote to memory of 1088	1792	cmd.exe	WMIC.exe
PID 1124 wrote to memory of 672	1124	VTProblem-VM (2).exe	cmd.exe
PID 1124 wrote to memory of 672	1124	VTProblem-VM (2).exe	cmd.exe
PID 1124 wrote to memory of 672	1124	VTProblem-VM (2).exe	cmd.exe
PID 1124 wrote to memory of 672	1124	VTProblem-VM (2).exe	cmd.exe
PID 672 wrote to memory of 1140	672	cmd.exe	tasklist.exe
PID 672 wrote to memory of 1140	672	cmd.exe	tasklist.exe
PID 672 wrote to memory of 1140	672	cmd.exe	tasklist.exe
PID 672 wrote to memory of 1140	672	cmd.exe	tasklist.exe

C:\Users\Admin\AppData\Local\Temp\VTProblem-VM (2).exe
"C:\Users\Admin\AppData\Local\Temp\VTProblem-VM (2).exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\taskmgr.exe
  "C:\Windows\System32\taskmgr.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c "wmic cpu get Architecture, Caption, Characteristics, Description, Family, L2CacheSize, L3CacheSize, Manufacturer, Name, ProcessorId, Version&wmic baseboard get Manufacturer,Product,SerialNumber & wmic bios get BIOSVersion,Caption,CurrentLanguage,Description,Manufacturer,ReleaseDate,SerialNumber,Version & wmic CSPRODUCT get &wmic MEMORYCHIP get BankLabel,Capacity,ConfiguredClockSpeed,ConfiguredVoltage,Manufacturer,PartNumber,SerialNumber,TypeDetail,Speed & wmic DISKDRIVE get Caption,DeviceID,FirmwareRevision,Model,PNPDeviceID,SerialNumber,Size,TotalCylinders,TotalSectors,TotalTracks
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get Architecture, Caption, Characteristics, Description, Family, L2CacheSize, L3CacheSize, Manufacturer, Name, ProcessorId, Version
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic baseboard get Manufacturer,Product,SerialNumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic bios get BIOSVersion,Caption,CurrentLanguage,Description,Manufacturer,ReleaseDate,SerialNumber,Version
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic CSPRODUCT get
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic MEMORYCHIP get BankLabel,Capacity,ConfiguredClockSpeed,ConfiguredVoltage,Manufacturer,PartNumber,SerialNumber,TypeDetail,Speed
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic DISKDRIVE get Caption,DeviceID,FirmwareRevision,Model,PNPDeviceID,SerialNumber,Size,TotalCylinders,TotalSectors,TotalTracks
    3⤵
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c "tasklist
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\0x7RT.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/672-67-0x0000000000000000-mapping.dmp

Download
memory/1064-63-0x0000000000000000-mapping.dmp

Download
memory/1088-66-0x0000000000000000-mapping.dmp

Download
memory/1124-55-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1124-56-0x00000000002F0000-0x0000000000304000-memory.dmp

Filesize
80KB

Download
memory/1124-54-0x0000000000AE0000-0x0000000000B20000-memory.dmp

Filesize
256KB

Download
memory/1140-68-0x0000000000000000-mapping.dmp

Download
memory/1544-64-0x0000000000000000-mapping.dmp

Download
memory/1652-65-0x0000000000000000-mapping.dmp

Download
memory/1792-60-0x0000000000000000-mapping.dmp

Download
memory/1936-62-0x0000000000000000-mapping.dmp

Download
memory/2008-61-0x0000000000000000-mapping.dmp

Download
memory/2020-58-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads