elysiumstealer | 705249820b77feedb545ebdaf04a7184938caf0d0d84b30eca7d1b2ab36f2307

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 12:53

Target

c5ecd86535c490f289f4e93894fcfcf0.exe
Size

1.6MB
MD5

c5ecd86535c490f289f4e93894fcfcf0
SHA1

12af49d55450aa8fd60b25dc4c438e1a26bbcfc1
SHA256

705249820b77feedb545ebdaf04a7184938caf0d0d84b30eca7d1b2ab36f2307
SHA512

c3920e7fb0aca9b3711f304f73e2ad2a022d64960347c8b07d288852d54b88eb8d053bd47da968176387e8cb2d78c9ada0b6216d89fc64f470702ce2ec1be06b
SSDEEP

24576:EVoqErngEsxUt7DshGPrmhIP9UfxM0uGdpzbEOLTiM4S6Y5RTt0c3jf5:oo3bgZwPahwifxM0uIpzNLTii1rTWc

Score

10^/10

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002326f-5.dat	elysiumstealer_dll

Loads dropped DLL 1 IoCs

pid	Process
4012	c5ecd86535c490f289f4e93894fcfcf0.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	4012	WerFault.exe	92

C:\Users\Admin\AppData\Local\Temp\c5ecd86535c490f289f4e93894fcfcf0.exe
"C:\Users\Admin\AppData\Local\Temp\c5ecd86535c490f289f4e93894fcfcf0.exe"
1⤵
- Loads dropped DLL
PID:4012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 1028
  2⤵
  - Program crash
  PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4012 -ip 4012
1⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4756 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:3316

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
memory/4012-0-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4012-1-0x0000000000F60000-0x0000000001102000-memory.dmp

Filesize
1.6MB

Download
memory/4012-2-0x0000000005D70000-0x0000000005D80000-memory.dmp

Filesize
64KB

Download
memory/4012-3-0x0000000003450000-0x000000000345C000-memory.dmp

Filesize
48KB

Download
memory/4012-8-0x0000000006330000-0x00000000068D4000-memory.dmp

Filesize
5.6MB

Download
memory/4012-9-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download