elysiumstealer | cde73f394ec6e7ac0454dbae70845d891a8d0f10fe68404c27ab0733b5e97a2e

General

Target

73454311df89d5d2a5e1a10495e38c62.exe
Size

12.6MB
MD5

73454311df89d5d2a5e1a10495e38c62
SHA1

12955d3dfff7dbe4a6ff91eb4f2772d19757aa6f
SHA256

cde73f394ec6e7ac0454dbae70845d891a8d0f10fe68404c27ab0733b5e97a2e
SHA512

87b6d6b9dddc69e94d4164a0bfd9448bddd538e06ec5b75cf8335a1d048cbe274845197961b4d98293383f11715c0b03a09805171008176e6bf0d99fd2d876b6
SSDEEP

393216:SFksBgG8sPNnMsU2k+LdLelGq/YKEDd/ceSihWiAQ6PJlDZ/:SFZB1P+NyYxAKC0eSiD1Q/

Score

10^/10

elysiumstealer stealer

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

73454311df89d5d2a5e1a10495e38c62.exe

pid process

1388 73454311df89d5d2a5e1a10495e38c62.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

73454311df89d5d2a5e1a10495e38c62.exe

pid process

1388 73454311df89d5d2a5e1a10495e38c62.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 1388 WerFault.exe 73454311df89d5d2a5e1a10495e38c62.exe

pid	pid_target	process	target process
1956	1388	WerFault.exe	73454311df89d5d2a5e1a10495e38c62.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

73454311df89d5d2a5e1a10495e38c62.exe

pid	process
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe
1388	73454311df89d5d2a5e1a10495e38c62.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

73454311df89d5d2a5e1a10495e38c62.exe

description pid process

Token: SeDebugPrivilege 1388 73454311df89d5d2a5e1a10495e38c62.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

73454311df89d5d2a5e1a10495e38c62.exe

pid process

1388 73454311df89d5d2a5e1a10495e38c62.exe

description	pid	process
Token: SeDebugPrivilege	1388	73454311df89d5d2a5e1a10495e38c62.exe

C:\Users\Admin\AppData\Local\Temp\73454311df89d5d2a5e1a10495e38c62.exe
"C:\Users\Admin\AppData\Local\Temp\73454311df89d5d2a5e1a10495e38c62.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 1244
  2⤵
  - Program crash
  PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1388 -ip 1388
1⤵
PID:4268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/1388-6-0x0000000076250000-0x0000000076340000-memory.dmp

Filesize
960KB

Download
memory/1388-11-0x00000000087B0000-0x0000000008D54000-memory.dmp

Filesize
5.6MB

Download
memory/1388-3-0x0000000000570000-0x0000000001B6C000-memory.dmp

Filesize
22.0MB

Download
memory/1388-4-0x0000000005180000-0x000000000518C000-memory.dmp

Filesize
48KB

Download
memory/1388-5-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/1388-0-0x0000000000570000-0x0000000001B6C000-memory.dmp

Filesize
22.0MB

Download
memory/1388-1-0x00000000FF4D0000-0x00000000FF8A1000-memory.dmp

Filesize
3.8MB

Download
memory/1388-2-0x0000000073C60000-0x0000000074410000-memory.dmp

Filesize
7.7MB

Download
memory/1388-12-0x0000000008140000-0x00000000081D2000-memory.dmp

Filesize
584KB

Download
memory/1388-13-0x0000000008110000-0x000000000811A000-memory.dmp

Filesize
40KB

Download
memory/1388-14-0x0000000000570000-0x0000000001B6C000-memory.dmp

Filesize
22.0MB

Download
memory/1388-15-0x00000000FF4D0000-0x00000000FF8A1000-memory.dmp

Filesize
3.8MB

Download
memory/1388-17-0x0000000076250000-0x0000000076340000-memory.dmp

Filesize
960KB

Download
memory/1388-16-0x0000000073C60000-0x0000000074410000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads