elysiumstealer | 705249820b77feedb545ebdaf04a7184938caf0d0d84b30eca7d1b2ab36f2307

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 12:53

Target

c5ecd86535c490f289f4e93894fcfcf0.exe
Size

1.6MB
MD5

c5ecd86535c490f289f4e93894fcfcf0
SHA1

12af49d55450aa8fd60b25dc4c438e1a26bbcfc1
SHA256

705249820b77feedb545ebdaf04a7184938caf0d0d84b30eca7d1b2ab36f2307
SHA512

c3920e7fb0aca9b3711f304f73e2ad2a022d64960347c8b07d288852d54b88eb8d053bd47da968176387e8cb2d78c9ada0b6216d89fc64f470702ce2ec1be06b
SSDEEP

24576:EVoqErngEsxUt7DshGPrmhIP9UfxM0uGdpzbEOLTiM4S6Y5RTt0c3jf5:oo3bgZwPahwifxM0uIpzNLTii1rTWc

Score

10^/10

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll	elysiumstealer_dll

Loads dropped DLL 1 IoCs

Processes:

c5ecd86535c490f289f4e93894fcfcf0.exe

pid process

2484 c5ecd86535c490f289f4e93894fcfcf0.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3016 2484 WerFault.exe c5ecd86535c490f289f4e93894fcfcf0.exe

pid	process
2484	c5ecd86535c490f289f4e93894fcfcf0.exe

pid	pid_target	process	target process
3016	2484	WerFault.exe	c5ecd86535c490f289f4e93894fcfcf0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c5ecd86535c490f289f4e93894fcfcf0.exe

description	pid	process	target process
PID 2484 wrote to memory of 3016	2484	c5ecd86535c490f289f4e93894fcfcf0.exe	WerFault.exe
PID 2484 wrote to memory of 3016	2484	c5ecd86535c490f289f4e93894fcfcf0.exe	WerFault.exe
PID 2484 wrote to memory of 3016	2484	c5ecd86535c490f289f4e93894fcfcf0.exe	WerFault.exe
PID 2484 wrote to memory of 3016	2484	c5ecd86535c490f289f4e93894fcfcf0.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 616
2⤵
- Program crash
PID:3016

\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll
Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/2484-1-0x0000000074C00000-0x00000000752EE000-memory.dmp

Filesize
6.9MB

Download
memory/2484-0-0x00000000002D0000-0x0000000000472000-memory.dmp

Filesize
1.6MB

Download
memory/2484-2-0x0000000004B30000-0x0000000004B70000-memory.dmp

Filesize
256KB

Download
memory/2484-3-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/2484-4-0x0000000076A30000-0x0000000076B40000-memory.dmp

Filesize
1.1MB

Download
memory/2484-8-0x0000000074C00000-0x00000000752EE000-memory.dmp

Filesize
6.9MB

Download
memory/2484-9-0x0000000004B30000-0x0000000004B70000-memory.dmp

Filesize
256KB

Download
memory/2484-10-0x0000000076A30000-0x0000000076B40000-memory.dmp

Filesize
1.1MB

Download