elysiumstealer | 8252ddb53b8b6564cb236c1693f8a9695ab9e48a90b3904a2bf7a34881e4c1f0

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe
Size

4.2MB
MD5

5ff5051e549747f6bedd8bee29406760
SHA1

a374166aaccbda485409926218cd2a98dfb35fc1
SHA256

8252ddb53b8b6564cb236c1693f8a9695ab9e48a90b3904a2bf7a34881e4c1f0
SHA512

fe28e001e44e67fc0b21edee572a9bcfa32f4eb91e29fb1d426281dc42f2c230d7c8a80693542502d9817df629547ca428257f08b45dfd70615715012a55026f
SSDEEP

98304:jd9IRzKP2vgMnK+lVsoVippEcnMR545balCTDAYPXbCz6pM:8RzYVMzVsppS89aH6LoKM

Score

10^/10

elysiumstealer stealer

Malware Config

Signatures

ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
stealer elysiumstealer

ElysiumStealer Support DLL 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000014251-9.dat	elysiumstealer_dll

Loads dropped DLL 3 IoCs

pid	Process
2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe
2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe
2552	WerFault.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	2292	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe
2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe
2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2552	2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe	28
PID 2292 wrote to memory of 2552	2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe	28
PID 2292 wrote to memory of 2552	2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe	28
PID 2292 wrote to memory of 2552	2292	5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5ff5051e549747f6bedd8bee29406760_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 772
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\VaultVM.Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
40KB

MD5
94173de2e35aa8d621fc1c4f54b2a082

SHA1
fbb2266ee47f88462560f0370edb329554cd5869

SHA256
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f

SHA512
cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

Download Submit
\Users\Admin\AppData\Local\Temp\tmpF3D.tmp\e87b821b-8913-4e4b-add3-0b2d42a3295f.dll

Filesize
770KB

MD5
fcdce22248e6f6751dd6e67360f2abd8

SHA1
689711c1954bc5f50a73b092e31a68f4a19299b9

SHA256
d5e1bef0eb91637790223515625e2c0dd77bb4591d2e58d1f65cfe0c75577c65

SHA512
d4e8ac8f8900dfd3041747cc116773008191fcd754fb1eec8e4cffe343393250adc02d7c55ddf11f4fc4c649bd27f3004b0ed65484659130d5ebc60ff23cc5dd

Download Submit
memory/2292-0-0x0000000073FBE000-0x0000000073FBF000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x0000000000BC0000-0x0000000000FF2000-memory.dmp

Filesize
4.2MB

Download
memory/2292-5-0x00000000004A0000-0x00000000004AE000-memory.dmp

Filesize
56KB

Download
memory/2292-6-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-7-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-11-0x0000000006500000-0x0000000006730000-memory.dmp

Filesize
2.2MB

Download
memory/2292-12-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-14-0x0000000073FBE000-0x0000000073FBF000-memory.dmp

Filesize
4KB

Download
memory/2292-15-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download