Overview

overview

10

Static

static

3

fa6e0187ef...18.exe

windows7-x64

10

fa6e0187ef...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 13:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fa6e0187ef7cfea6cd62311f1d0da117_JaffaCakes118.exe

  • Size

    120KB

  • MD5

    fa6e0187ef7cfea6cd62311f1d0da117

  • SHA1

    07ea78318b4ba3e5dfd16db9f56095e8372fca86

  • SHA256

    5fc412dbc2a4b4984ffee36a413454aa54f8a4f41d916e367f7bcc0ddd490842

  • SHA512

    fcdd86c10db585a90c4b38a06240307bedbf1e299a18939b83d374dd44a798da7a55cb784dfbbd0869f4be28ddbc9c4cb05bcda65f4abf4fdfd1122fd87228dc

  • SSDEEP

    1536:CqQZ/Nus4phrF6RY5BDgWLXqnm4HVxjInkWrVFU/O9uSFAd2ZgkwVcl1:hcw6RYDgWLMm4snkWrL+SFA4ZgkqY1

Score
10/10
elysiumstealerstealer

Malware Config

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • ElysiumStealer Support DLL 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa6e0187ef7cfea6cd62311f1d0da117_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa6e0187ef7cfea6cd62311f1d0da117_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:468
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2728

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll
      Filesize

      40KB

      MD5

      94173de2e35aa8d621fc1c4f54b2a082

      SHA1

      fbb2266ee47f88462560f0370edb329554cd5869

      SHA256

      7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

      SHA512

      cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

      Download Submit

    • memory/468-0-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/468-1-0x0000000000450000-0x0000000000474000-memory.dmp

      Filesize

      144KB

      Download

    • memory/468-2-0x0000000004F60000-0x0000000004F70000-memory.dmp

      Filesize

      64KB

      Download

    • memory/468-3-0x0000000000F20000-0x0000000000F2C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/468-8-0x0000000074520000-0x0000000074CD0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/468-9-0x0000000004F60000-0x0000000004F70000-memory.dmp

      Filesize

      64KB

      Download