Malware Analysis Report

2024-08-06 08:28

Sample ID 231219-q22rlsgfcl
Target 382cf0f7043d55caaa764f9975bf84b7
SHA256 1575511f0feb385dae8d7ce99ddb69aea3485b62499e4b0e37833eb2bd7c07fb
Tags
elysiumstealer stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1575511f0feb385dae8d7ce99ddb69aea3485b62499e4b0e37833eb2bd7c07fb

Threat Level: Known bad

The file 382cf0f7043d55caaa764f9975bf84b7 was found to be: Known bad.

Malicious Activity Summary

elysiumstealer stealer

ElysiumStealer

ElysiumStealer Support DLL

Loads dropped DLL

Program crash

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2023-12-19 13:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-19 13:46

Reported

2023-12-19 17:09

Platform

win7-20231215-en

Max time kernel

119s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe"

Signatures

ElysiumStealer

stealer elysiumstealer

ElysiumStealer Support DLL

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1768 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe C:\Windows\SysWOW64\WerFault.exe
PID 1768 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe C:\Windows\SysWOW64\WerFault.exe
PID 1768 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe C:\Windows\SysWOW64\WerFault.exe
PID 1768 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe

"C:\Users\Admin\AppData\Local\Temp\382cf0f7043d55caaa764f9975bf84b7.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 664

Network

N/A

Files

memory/1768-0-0x0000000000A80000-0x0000000000AA6000-memory.dmp

memory/1768-1-0x0000000074AC0000-0x00000000751AE000-memory.dmp

memory/1768-3-0x0000000001F00000-0x0000000001F40000-memory.dmp

memory/1768-2-0x0000000000290000-0x000000000029C000-memory.dmp

memory/1768-5-0x0000000075A20000-0x0000000075B30000-memory.dmp

\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

MD5 94173de2e35aa8d621fc1c4f54b2a082
SHA1 fbb2266ee47f88462560f0370edb329554cd5869
SHA256 7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512 cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

memory/1768-8-0x0000000001F00000-0x0000000001F40000-memory.dmp

memory/1768-9-0x0000000074AC0000-0x00000000751AE000-memory.dmp

memory/1768-10-0x0000000001F00000-0x0000000001F40000-memory.dmp

memory/1768-11-0x0000000075A20000-0x0000000075B30000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-19 13:46

Reported

2023-12-19 17:05

Platform

win10v2004-20231201-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A