elysiumstealer | 811e02d249ebce5faa385b01605297d336d2d79b38e6aab3d39b7c16130e292c

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2023 04:09

Target

VenomClient.exe
Size

1.0MB
MD5

946c7e976efefd4d2cd134dc3d884fe1
SHA1

8ddf0dac85719a03e03114eab2f3a9a3f1f5c125
SHA256

811e02d249ebce5faa385b01605297d336d2d79b38e6aab3d39b7c16130e292c
SHA512

239a2bf2aee7e1bc0eed3ae02f7b13981f93f635036adf1ee5ea4a9d72b45d4756447afd273b25c68922b585786b0d4ddc61d66c3231947d514768215964b210
SSDEEP

24576:ZwV7Scs+DPiLFEHTCxRXIeDHX+JSQuYHuOjwaWfDjxExnDYPtimEM0J:Z+7Scs+DP5zkRXIeX+JSQuYHuOjwaWfs

Score

10^/10

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\0x7RT.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

VenomClient.exe

pid process

1216 VenomClient.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4800 1216 WerFault.exe VenomClient.exe

pid	process
1216	VenomClient.exe

pid	pid_target	process	target process
4800	1216	WerFault.exe	VenomClient.exe

C:\Users\Admin\AppData\Local\Temp\VenomClient.exe
"C:\Users\Admin\AppData\Local\Temp\VenomClient.exe"
1⤵
- Loads dropped DLL
PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 1064
  2⤵
  - Program crash
  PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1216 -ip 1216
1⤵
PID:1436

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\0x7RT.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/1216-133-0x0000000000C40000-0x0000000000D4C000-memory.dmp

Filesize
1.0MB

Download
memory/1216-134-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/1216-135-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/1216-140-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/1216-141-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/1216-142-0x0000000005970000-0x000000000597A000-memory.dmp

Filesize
40KB

Download
memory/1216-143-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download