elysiumstealer | f53614a1f94813c9923414de84098b3295e63eaeea93f9e25dbcb75c69385e64

Analysis

max time kernel
139s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 17:54

Target

6f863697c00b6c7db3bfb9af631618fa.exe
Size

455KB
MD5

6f863697c00b6c7db3bfb9af631618fa
SHA1

ccbfe4b232bb3a48e4f5a750f80ae2df07cb1a81
SHA256

f53614a1f94813c9923414de84098b3295e63eaeea93f9e25dbcb75c69385e64
SHA512

6cf60dd6d5dcfe0b61890a4afdb62f7dd64ef0e49b647fff159127c8ec3370da70b43cc0f0524becae8b65d153f211225d27afdda9c08449607daf953825e491
SSDEEP

6144:4TenJ+iKoyWTgE8LMJsdj2GE/obaoy17X:4ynJ+1sYf3EdTX

Score

10^/10

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

6f863697c00b6c7db3bfb9af631618fa.exe

pid process

4348 6f863697c00b6c7db3bfb9af631618fa.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2172 4348 WerFault.exe 6f863697c00b6c7db3bfb9af631618fa.exe

pid	process
4348	6f863697c00b6c7db3bfb9af631618fa.exe

pid	pid_target	process	target process
2172	4348	WerFault.exe	6f863697c00b6c7db3bfb9af631618fa.exe

C:\Users\Admin\AppData\Local\Temp\6f863697c00b6c7db3bfb9af631618fa.exe
"C:\Users\Admin\AppData\Local\Temp\6f863697c00b6c7db3bfb9af631618fa.exe"
1⤵
- Loads dropped DLL
PID:4348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 1080
  2⤵
  - Program crash
  PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4348 -ip 4348
1⤵
PID:1980

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/4348-0-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/4348-1-0x00000000001D0000-0x0000000000248000-memory.dmp

Filesize
480KB

Download
memory/4348-2-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/4348-3-0x0000000002640000-0x000000000264C000-memory.dmp

Filesize
48KB

Download
memory/4348-8-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download
memory/4348-9-0x0000000004B80000-0x0000000004B90000-memory.dmp

Filesize
64KB

Download
memory/4348-10-0x0000000074CC0000-0x0000000075470000-memory.dmp

Filesize
7.7MB

Download