elysiumstealer | 695261e94d126068438a1fece9d9f102dd8fcdb1dc0fa2bf6118980fc7d6202b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58c26fede0b15384b698d3c5770ef44c.exe
Size

4.0MB
MD5

58c26fede0b15384b698d3c5770ef44c
SHA1

80d43d4a15e497af93bcb2f5282f36acc2976f50
SHA256

695261e94d126068438a1fece9d9f102dd8fcdb1dc0fa2bf6118980fc7d6202b
SHA512

7fc48f54b22d06a596ed0550c6892dc591e464af81a9b5bcc1b173e054fe8e3650f82aad0a1a04602262036d6edf1224a93d0d37b29efd7fcf20c328e954f137
SSDEEP

49152:OfGyxeOre51jKP48yZXHVSuoaesz60QI/Eteij+RqzyEk4tH+w9IiwsmOKwpvgu7:oGWbOm45DoMzLQI8eija0ki9I+Xbc8f

Score

10^/10

elysiumstealer stealer

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

58c26fede0b15384b698d3c5770ef44c.exe

pid process

624 58c26fede0b15384b698d3c5770ef44c.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

58c26fede0b15384b698d3c5770ef44c.exe

pid process

624 58c26fede0b15384b698d3c5770ef44c.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4488 624 WerFault.exe 58c26fede0b15384b698d3c5770ef44c.exe

pid	pid_target	process	target process
4488	624	WerFault.exe	58c26fede0b15384b698d3c5770ef44c.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

58c26fede0b15384b698d3c5770ef44c.exe

pid	process
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe
624	58c26fede0b15384b698d3c5770ef44c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

58c26fede0b15384b698d3c5770ef44c.exe

description pid process

Token: SeDebugPrivilege 624 58c26fede0b15384b698d3c5770ef44c.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

58c26fede0b15384b698d3c5770ef44c.exe

pid process

624 58c26fede0b15384b698d3c5770ef44c.exe

description	pid	process
Token: SeDebugPrivilege	624	58c26fede0b15384b698d3c5770ef44c.exe

C:\Users\Admin\AppData\Local\Temp\58c26fede0b15384b698d3c5770ef44c.exe
"C:\Users\Admin\AppData\Local\Temp\58c26fede0b15384b698d3c5770ef44c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 1188
  2⤵
  - Program crash
  PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 624 -ip 624
1⤵
PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/624-4-0x00000000046B0000-0x00000000046BC000-memory.dmp

Filesize
48KB

Download
memory/624-2-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/624-3-0x0000000000730000-0x00000000012AA000-memory.dmp

Filesize
11.5MB

Download
memory/624-5-0x0000000006BB0000-0x0000000006BC0000-memory.dmp

Filesize
64KB

Download
memory/624-6-0x0000000075E10000-0x0000000075F00000-memory.dmp

Filesize
960KB

Download
memory/624-0-0x0000000000730000-0x00000000012AA000-memory.dmp

Filesize
11.5MB

Download
memory/624-1-0x00000000FECD0000-0x00000000FF0A1000-memory.dmp

Filesize
3.8MB

Download
memory/624-11-0x00000000078A0000-0x0000000007E44000-memory.dmp

Filesize
5.6MB

Download
memory/624-12-0x0000000000730000-0x00000000012AA000-memory.dmp

Filesize
11.5MB

Download
memory/624-15-0x0000000075E10000-0x0000000075F00000-memory.dmp

Filesize
960KB

Download
memory/624-14-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/624-13-0x00000000FECD0000-0x00000000FF0A1000-memory.dmp

Filesize
3.8MB

Download