Analysis
- max time kernel
124s - max time network
127s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
14/10/2021, 15:13
General
- Target a9dea10c6d4d205faab1ac8db69384e9c3dc91fd5a718266957e4e164f76cd4a.bin.exe
- Size 311KB
- Sample211014-slznesafgr
- SHA256 a9dea10c6d4d205faab1ac8db69384e9c3dc91fd5a718266957e4e164f76cd4a
Score
10/10
Malware Config
Extracted
Family
-
arkei
Botnet
-
Default
C2
-
http://game2030.link/ggate.php
Signatures
- Arkei
Arkei is an infostealer written in C++.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Arkei Stealer Payload 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9dea10c6d4d205faab1ac8db69384e9c3dc91fd5a718266957e4e164f76cd4a.bin.exe"C:\Users\Admin\AppData\Local\Temp\a9dea10c6d4d205faab1ac8db69384e9c3dc91fd5a718266957e4e164f76cd4a.bin.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 12042⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3644-115-0x00000000018B6000-0x00000000018C6000-memory.dmp
memory/3644-116-0x00000000016C0000-0x000000000180A000-memory.dmp
memory/3644-117-0x0000000000400000-0x00000000016C0000-memory.dmp