Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15/01/2022, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
bfa2ac832261df46640df025737b8c4a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
bfa2ac832261df46640df025737b8c4a.exe
Resource
win10v2004-en-20220113
General
-
Target
bfa2ac832261df46640df025737b8c4a.exe
-
Size
316KB
-
MD5
bfa2ac832261df46640df025737b8c4a
-
SHA1
d7922ef0cef7cc4f7ce9df47ba4de6c9822f14a9
-
SHA256
81bc6e0cf586a808ef3ee9c5ace20622f414853a8606007357104c39f5fa5693
-
SHA512
097cd3a632d90ecc95531c467b5460aa48d397887c17838ad17a53b7a1162cf3b78c45e978a030d637aef98fcf50444baf4fbef35c8501f8b6e5885b1f50bea9
Malware Config
Extracted
arkei
Default
http://209.209.115.111/SYiQ6N1zUJ.php
Signatures
-
Arkei Stealer Payload 2 IoCs
resource yara_rule behavioral1/memory/1368-57-0x0000000000400000-0x000000000055F000-memory.dmp family_arkei behavioral1/memory/1368-56-0x0000000000220000-0x000000000023C000-memory.dmp family_arkei -
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 1832 cmd.exe -
Loads dropped DLL 5 IoCs
pid Process 1368 bfa2ac832261df46640df025737b8c4a.exe 1368 bfa2ac832261df46640df025737b8c4a.exe 1368 bfa2ac832261df46640df025737b8c4a.exe 1368 bfa2ac832261df46640df025737b8c4a.exe 1368 bfa2ac832261df46640df025737b8c4a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bfa2ac832261df46640df025737b8c4a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString bfa2ac832261df46640df025737b8c4a.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1768 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1832 1368 bfa2ac832261df46640df025737b8c4a.exe 29 PID 1368 wrote to memory of 1832 1368 bfa2ac832261df46640df025737b8c4a.exe 29 PID 1368 wrote to memory of 1832 1368 bfa2ac832261df46640df025737b8c4a.exe 29 PID 1368 wrote to memory of 1832 1368 bfa2ac832261df46640df025737b8c4a.exe 29 PID 1832 wrote to memory of 1768 1832 cmd.exe 31 PID 1832 wrote to memory of 1768 1832 cmd.exe 31 PID 1832 wrote to memory of 1768 1832 cmd.exe 31 PID 1832 wrote to memory of 1768 1832 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfa2ac832261df46640df025737b8c4a.exe"C:\Users\Admin\AppData\Local\Temp\bfa2ac832261df46640df025737b8c4a.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\bfa2ac832261df46640df025737b8c4a.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1768
-
-