Overview

overview

10

Static

static

1

VTProblem-VM (2).exe

windows7-x64

10

VTProblem-VM (2).exe

windows10-2004-x64

10

Resubmissions

19-02-2023 16:10

230219-tmlzdsfh96 10

19-02-2023 16:06

230219-tj4p2afd3z 10

19-02-2023 16:05

230219-tjjd4afh92 10

19-02-2023 16:04

230219-th18hsfd3x 10

Analysis

  • max time kernel
    46s
  • max time network
    48s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-02-2023 16:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VTProblem-VM (2).exe

  • Size

    232KB

  • MD5

    517b49453e545a36c8f1a3bc33251cc5

  • SHA1

    e8a06fdbfbb2dc8052ede370bd977da819224a0d

  • SHA256

    48ee8d72d38ee855eafaf022a158d649d32e1b4e919e7b6f8d8b94ce47e43e98

  • SHA512

    a477ff24d032418ca17951d69cbcd77eb0d56784d96e58505077c69ead5fe0787869a756a8fb00f9c61a7aa4adb8c026acd571b6f330cae87ca020b5f498c9fe

  • SSDEEP

    6144:Iio6TsKXWMLMJsVX+J4WAQ9mhYHuOjwae9fDjxExnDE7RPiA0:IA4QWCHX+JSQ9mhYHuOjwae9fDjxExnI

Score
10/10
elysiumstealerstealer

Malware Config

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • ElysiumStealer Support DLL 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VTProblem-VM (2).exe
    "C:\Users\Admin\AppData\Local\Temp\VTProblem-VM (2).exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Windows\SysWOW64\Taskmgr.exe
      "C:\Windows\System32\Taskmgr.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1836
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c "wmic cpu get Architecture, Caption, Characteristics, Description, Family, L2CacheSize, L3CacheSize, Manufacturer, Name, ProcessorId, Version&wmic baseboard get Manufacturer,Product,SerialNumber & wmic bios get BIOSVersion,Caption,CurrentLanguage,Description,Manufacturer,ReleaseDate,SerialNumber,Version & wmic CSPRODUCT get &wmic MEMORYCHIP get BankLabel,Capacity,ConfiguredClockSpeed,ConfiguredVoltage,Manufacturer,PartNumber,SerialNumber,TypeDetail,Speed & wmic DISKDRIVE get Caption,DeviceID,FirmwareRevision,Model,PNPDeviceID,SerialNumber,Size,TotalCylinders,TotalSectors,TotalTracks
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic cpu get Architecture, Caption, Characteristics, Description, Family, L2CacheSize, L3CacheSize, Manufacturer, Name, ProcessorId, Version
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4092
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic baseboard get Manufacturer,Product,SerialNumber
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4584
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic bios get BIOSVersion,Caption,CurrentLanguage,Description,Manufacturer,ReleaseDate,SerialNumber,Version
        3⤵
          PID:1068
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic CSPRODUCT get
          3⤵
            PID:3788
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic MEMORYCHIP get BankLabel,Capacity,ConfiguredClockSpeed,ConfiguredVoltage,Manufacturer,PartNumber,SerialNumber,TypeDetail,Speed
            3⤵
              PID:216
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic DISKDRIVE get Caption,DeviceID,FirmwareRevision,Model,PNPDeviceID,SerialNumber,Size,TotalCylinders,TotalSectors,TotalTracks
              3⤵
                PID:4116
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c "tasklist
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1260
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                3⤵
                • Enumerates processes with tasklist
                PID:4436

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\0x7RT.dll
            Filesize

            40KB

            MD5

            94173de2e35aa8d621fc1c4f54b2a082

            SHA1

            fbb2266ee47f88462560f0370edb329554cd5869

            SHA256

            7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

            SHA512

            cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

            Download Submit

          • memory/216-141-0x0000000000000000-mapping.dmp

            Download

          • memory/1068-139-0x0000000000000000-mapping.dmp

            Download

          • memory/1260-143-0x0000000000000000-mapping.dmp

            Download

          • memory/1392-136-0x0000000000000000-mapping.dmp

            Download

          • memory/1836-135-0x0000000000000000-mapping.dmp

            Download

          • memory/2500-132-0x00000000004B0000-0x00000000004F0000-memory.dmp

            Filesize

            256KB

            Download

          • memory/2500-133-0x0000000005640000-0x0000000005BE4000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/2500-145-0x0000000005FF0000-0x0000000006082000-memory.dmp

            Filesize

            584KB

            Download

          • memory/3788-140-0x0000000000000000-mapping.dmp

            Download

          • memory/4092-137-0x0000000000000000-mapping.dmp

            Download

          • memory/4116-142-0x0000000000000000-mapping.dmp

            Download

          • memory/4436-144-0x0000000000000000-mapping.dmp

            Download

          • memory/4584-138-0x0000000000000000-mapping.dmp

            Download