Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
382cf0f7043d55caaa764f9975bf84b7.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
382cf0f7043d55caaa764f9975bf84b7.exe
Resource
win10v2004-20231201-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
382cf0f7043d55caaa764f9975bf84b7.exe
-
Size
127KB
-
MD5
382cf0f7043d55caaa764f9975bf84b7
-
SHA1
8c63588d05ea6dc7212adcf80f53d64e9f4ddeb1
-
SHA256
1575511f0feb385dae8d7ce99ddb69aea3485b62499e4b0e37833eb2bd7c07fb
-
SHA512
2d700d098b0cf205a2d4c48613fa47fd9ef11f8ab282c03089ddebc7e7a0fbebc7532703110346deca10c42c137254c6d9e700b36adca29bf9841ea86cc26c16
-
SSDEEP
1536:Q1V/Nus4phrF6RY5BDgWLXqnm4HVxjInkWr9ITlaN9QSmNLbb+r4A7dY3:qw6RYDgWLMm4snkWr9oa8SmNvb+q
Score
10/10
Malware Config
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Support DLL 1 IoCs
resource yara_rule behavioral1/files/0x000f000000015c2f-6.dat elysiumstealer_dll -
Loads dropped DLL 1 IoCs
pid Process 1768 382cf0f7043d55caaa764f9975bf84b7.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2768 1768 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe 1768 382cf0f7043d55caaa764f9975bf84b7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1768 382cf0f7043d55caaa764f9975bf84b7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2768 1768 382cf0f7043d55caaa764f9975bf84b7.exe 29 PID 1768 wrote to memory of 2768 1768 382cf0f7043d55caaa764f9975bf84b7.exe 29 PID 1768 wrote to memory of 2768 1768 382cf0f7043d55caaa764f9975bf84b7.exe 29 PID 1768 wrote to memory of 2768 1768 382cf0f7043d55caaa764f9975bf84b7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe"C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 6642⤵
- Program crash
PID:2768
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD594173de2e35aa8d621fc1c4f54b2a082
SHA1fbb2266ee47f88462560f0370edb329554cd5869
SHA2567e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798