Analysis
-
max time kernel
83s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 12:59
Static task
static1
Behavioral task
behavioral1
Sample
94c3dee9afca99166dab6ff6d0547d11.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
94c3dee9afca99166dab6ff6d0547d11.exe
Resource
win10v2004-20231215-en
General
-
Target
94c3dee9afca99166dab6ff6d0547d11.exe
-
Size
14.6MB
-
MD5
94c3dee9afca99166dab6ff6d0547d11
-
SHA1
6979d0c7cc3d96e3a5dc5dc67f4be479f1f6c7c9
-
SHA256
17bc7716f8525fdca444ef41c66e0b35149fba99ff0450afa75af1d201077f09
-
SHA512
6f95f55ed83e96d6c8f275b5cafab4eab551bc6373ed74a9a0b75d32b7f4508100cdbeae818e8422088bc979ca202d5d9930f08bf7ac44bf152699e6e3c5fb8d
-
SSDEEP
393216:icQmyQufRsZmS1wyrvW71cjH6YG+wygF:iJmybOsC21cjaMTgF
Malware Config
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Support DLL 1 IoCs
resource yara_rule behavioral2/files/0x000800000002321f-8.dat elysiumstealer_dll -
Loads dropped DLL 1 IoCs
pid Process 3876 94c3dee9afca99166dab6ff6d0547d11.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe 3876 94c3dee9afca99166dab6ff6d0547d11.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3876 94c3dee9afca99166dab6ff6d0547d11.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3876 94c3dee9afca99166dab6ff6d0547d11.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94c3dee9afca99166dab6ff6d0547d11.exe"C:\Users\Admin\AppData\Local\Temp\94c3dee9afca99166dab6ff6d0547d11.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3876
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD594173de2e35aa8d621fc1c4f54b2a082
SHA1fbb2266ee47f88462560f0370edb329554cd5869
SHA2567e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798