Analysis
-
max time kernel
106s -
max time network
100s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
19-11-2024 07:22
General
-
Target
NoCry Ransomware Builder 2021.rar.zip
-
Size
7.9MB
-
MD5
fb5356fb440dcf8013e39c891d626d90
-
SHA1
1263f585f64b7fb55ee735c92a562f2fa0882b18
-
SHA256
be14698dddf38be027a4f4178b4f33d5d98e14f879064812a15e54c1eee91cb5
-
SHA512
1809ae1b8efbe7197b179187c7a1df8b69432b3ff398277a5a5230ec7f9e9f2f40ea1a430118d22a0eb345d7c97ad8adde09c91a09f5c9cb98a5fc552ba16f7a
-
SSDEEP
196608:5Cxn100Yr+gjTFg9mcYBHexffSfpvbAF/Zvp0lE8gFVEzfnPoOK6CX:UuKgvEmcYB+5A1bez0lE8gFVETsPX
Malware Config
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Support DLL 1 IoCs
-
Elysiumstealer family
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NoCry Ransomware Builder 2021.rar.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\NoCry Ransomware Builder 2021\NoCry Ransomware Builder.exe"C:\Users\Admin\Desktop\NoCry Ransomware Builder 2021\NoCry Ransomware Builder.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD594173de2e35aa8d621fc1c4f54b2a082
SHA1fbb2266ee47f88462560f0370edb329554cd5869
SHA2567e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798
-
Filesize
647KB
MD55afda7c7d4f7085e744c2e7599279db3
SHA13a833eb7c6be203f16799d7b7ccd8b8c9d439261
SHA256f58c374ffcaae4e36d740d90fbf7fe70d0abb7328cd9af3a0a7b70803e994ba4
SHA5127cbbbef742f56af80f1012d7da86fe5375ac05813045756fb45d0691c36ef13c069361457500ba4200157d5ee7922fd118bf4c0635e5192e3f8c6183fd580944
-
Filesize
7.1MB
MD5d15f2df43b25f5534336339b37b49ea8
SHA10c048d1a86ef468625403b6c1e117e82d3602422
SHA2561aefedf48ed1b83203f997868822de9950ec2d965aaa386d83ec658ca8f48431
SHA512b4766962f2a8279289d3c9f42d8e2e4c8222dae6db79fd0b62922e2174fa8f081c1ab53510ca64f6e70e53587017a0fb447b86652b6d0299b4e202a34f8f7698
-
Filesize
1.2MB
MD51d5041dc5a86b787d9701b78a9e0b121
SHA188873d0af22c924869f8c10c46e9b8f765d9b998
SHA2564870018813eff9a5b050044c5eb639bb3e536ec1cd3ad03da389b83216c0f4d5
SHA51265b10e3ed76886d6649b9d7a13d9072cc6ee4026632ad588551020df634d065f30691f62b394da96eaf870226dc8272a04b92648c999fc7329573a9e2383af4b
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
48KB
-
Filesize
7.1MB
-
Filesize
136KB
-
Filesize
304KB
-
Filesize
320KB
-
Filesize
672KB
-
Filesize
240KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB