chromelevator | b8e2d8c21e1c2ec725a2661b03b318dc9ce7e7628ac5248cf20eef3b4d6876bd

Sharing

Copy URL Twitter E-mail

General

Target
b8e2d8c21e1c2ec725a2661b03b318dc9ce7e7628ac5248cf20eef3b4d6876bd
Size 2.4MB
Sample260826-tdd77aeb53
SHA256 b8e2d8c21e1c2ec725a2661b03b318dc9ce7e7628ac5248cf20eef3b4d6876bd
MD5 9bd5f75f8c79b5c711e3a7009cf857f2
SHA1 4e97fe9596c1ae8fb2ec9dda499f06004adf6886
SHA512 3b7d0f1bc4fa9b5d97b1f4230dd0fe4bd528c3a596fedaf9a5eea334390f3c728f2ead835049dcaead115ebf2f8bc7dca3e6f9ff91b952f718f199d4a8d56045
SSDEEP 49152:BKC4V/08lvUX96RLIg0Opy3aP1CeI+p4ROO4RK:c+tX9LRA1JT/
TLSH
T1BAB5D11AE368017CE2E7C2F5CA5A4613EBB2B8451330969F57D98E9E2F37B60523D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacktool chromelevator

Malware Config

Signatures

Family: ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
hacktool chromelevator

Detects ChromElevator 1 IoCs

resource	yara_rule
sample	family_chromelevator

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8e2d8c21e1c2ec725a2661b03b318dc9ce7e7628ac5248cf20eef3b4d6876bd

File Explorer

b8e2d8c21e1c2ec725a2661b03b318dc9ce7e7628ac5248cf20eef3b4d6876bd

.exe 2.4MB

b8e2d8c21e1c2ec725a2661b03b318dc9ce7e7628ac5248cf20eef3b4d6876bd

IMPHASH efa87b753c731f645229b10dbb9bb938
SHA256 b8e2d8c21e1c2ec725a2661b03b318dc9ce7e7628ac5248cf20eef3b4d6876bd
MD5 9bd5f75f8c79b5c711e3a7009cf857f2
SHA1 4e97fe9596c1ae8fb2ec9dda499f06004adf6886
SHA512 3b7d0f1bc4fa9b5d97b1f4230dd0fe4bd528c3a596fedaf9a5eea334390f3c728f2ead835049dcaead115ebf2f8bc7dca3e6f9ff91b952f718f199d4a8d56045
SSDEEP 49152:BKC4V/08lvUX96RLIg0Opy3aP1CeI+p4ROO4RK:c+tX9LRA1JT/
TLSH
T1BAB5D11AE368017CE2E7C2F5CA5A4613EBB2B8451330969F57D98E9E2F37B60523D710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects ChromElevator
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

865644

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetSetOptionA HttpQueryInfoA HttpOpenRequestA InternetOpenUrlW InternetOpenUrlA InternetOpenW InternetReadFile HttpAddRequestHeadersA InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipSaveImageToFile GdipCloneImage GdiplusShutdown GdiplusStartup GdipGetImageEncoders GdipAlloc

advapi32

CryptReleaseContext RegOpenKeyExA CheckTokenMembership FreeSid OpenProcessToken CryptDestroyHash CryptHashData CryptAcquireContextA RegCloseKey RegQueryValueExA AllocateAndInitializeSid GetUserNameA CryptCreateHash CryptGetHashParam

user32

GetSystemMetrics EnumDisplaySettingsA ReleaseDC GetDC

iphlpapi

GetAdaptersInfo SendARP

gdi32

GetDeviceCaps DeleteObject SelectObject CreateCompatibleBitmap BitBlt CreateCompatibleDC DeleteDC

ws2_32

inet_addr

kernel32

UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW CompareStringW GetFileSizeEx GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation IsValidCodePage TerminateProcess ExitProcess GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW SetFilePointerEx LCMapStringW GetFileType GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW SetFilePointer FreeLibraryAndExitThread ReadFile SizeofResource GetLogicalDrives Process32First SetHandleInformation GetCurrentProcess WriteFile ExpandEnvironmentStringsW GetModuleFileNameW CreateNamedPipeW CreatePipe GetEnvironmentVariableW PeekNamedPipe GetTempPathW WaitForSingleObject CreateFileW GetCurrentThreadId GetModuleHandleA GetLocaleInfoA CreateToolhelp32Snapshot Sleep GetTickCount64 GetLastError GetFileAttributesA CreateFileA LockResource DeleteFileW Process32Next CloseHandle LoadResource FindResourceW GetLocalTime GetProcAddress GetFileSize GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW WideCharToMultiByte GetTickCount GetDriveTypeW ConnectNamedPipe GetComputerNameA FlushFileBuffers GetExitCodeProcess IsDebuggerPresent OutputDebugStringA LoadLibraryW FreeLibrary AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection RtlUnwind GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA HeapReAlloc RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFinalPathNameByHandleW SetFileInformationByHandle CreateFile2 DeviceIoControl CopyFile2 CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo WakeAllConditionVariable InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW ExitThread RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread

Name

.text

Size

1016KB

Virtual Size

1020KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

209KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

22KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b8e2d8c21e1c2ec725a2661b03b318dc9ce7e7628ac5248cf20eef3b4d6876bd

version

wininet

gdiplus

advapi32

user32

iphlpapi

gdi32

ws2_32

kernel32

generic