Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 12:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36997ded6557a05fd6fae3c6a5aa80ce.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
36997ded6557a05fd6fae3c6a5aa80ce.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
36997ded6557a05fd6fae3c6a5aa80ce.exe
-
Size
401KB
-
MD5
36997ded6557a05fd6fae3c6a5aa80ce
-
SHA1
6177a0d420f2fa13fe52df21bd846d551012a69b
-
SHA256
943ce6698111d124cdf2c27a123c743a281d3f2299e39fdfd28abfbecd0deee2
-
SHA512
522d9b04bd281b522d1ab5bc9b06d76268bba51324e32e4c3529687d434e177eadab5bb3d8b71146b170604947aed0c601c6957f4ff5b035f5153f6c277e62ce
-
SSDEEP
3072:Rco1T04Bsgj0nP3tl1Ww6RYDgWLMm4snkWrptSp3lM+fYs102l5Yo1CL:jiIsll7LMJsG1
Score
10/10
Malware Config
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Support DLL 1 IoCs
resource yara_rule behavioral2/files/0x000d000000023151-6.dat elysiumstealer_dll -
Loads dropped DLL 1 IoCs
pid Process 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3492 36997ded6557a05fd6fae3c6a5aa80ce.exe