Analysis
-
max time kernel
4265058s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
15/01/2022, 04:03
Static task
static1
General
-
Target
f1ff0817cd12a7c79fe812becb7c34fbf07548b70d2e64485517f82971ff0525.exe
-
Size
322KB
-
MD5
458ed95fd43e6a1594920b127deabd29
-
SHA1
98f485fc5d4b1510193d36b5e98774f2fddcc756
-
SHA256
f1ff0817cd12a7c79fe812becb7c34fbf07548b70d2e64485517f82971ff0525
-
SHA512
53f2e3a4dcd367557ad799e58ccc381a3597e38267a7010bc06edc1d67810e36bcb5d2a1909e9ff038cff2f204f0c160cd922384179a60883d4487d73126a099
Malware Config
Extracted
Family
arkei
Botnet
Default
C2
http://file-file-host4.com/tratata.php
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3428 created 3016 3428 WerFault.exe 52 -
Arkei Stealer Payload 2 IoCs
resource yara_rule behavioral1/memory/3016-132-0x0000000000400000-0x0000000000560000-memory.dmp family_arkei behavioral1/memory/3016-131-0x00000000022A0000-0x00000000022BC000-memory.dmp family_arkei -
Program crash 1 IoCs
pid pid_target Process procid_target 1700 3016 WerFault.exe 52 -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotification.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotification.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1700 WerFault.exe 1700 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2176 MusNotification.exe Token: SeCreatePagefilePrivilege 2176 MusNotification.exe Token: SeRestorePrivilege 1700 WerFault.exe Token: SeBackupPrivilege 1700 WerFault.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3428 wrote to memory of 3016 3428 WerFault.exe 52 PID 3428 wrote to memory of 3016 3428 WerFault.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1ff0817cd12a7c79fe812becb7c34fbf07548b70d2e64485517f82971ff0525.exe"C:\Users\Admin\AppData\Local\Temp\f1ff0817cd12a7c79fe812becb7c34fbf07548b70d2e64485517f82971ff0525.exe"1⤵PID:3016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 5522⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3016 -ip 30161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3428
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2176