Analysis
-
max time kernel
110s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15/01/2022, 11:27
Static task
static1
General
-
Target
16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe
-
Size
316KB
-
MD5
a3619e91fa1245858d34030236ec696b
-
SHA1
340d0ea5548b85ff429ae7102097c1b75160d236
-
SHA256
16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04
-
SHA512
df550b2351ce208c159fd4f71433e463282b8ca5fd4831e8ca287d6867935b9dd3c40718953352c9e5bea143c7ecfeb39efe7179f59de830a7adb7c887617512
Malware Config
Extracted
arkei
Default
http://file-file-host4.com/tratata.php
Signatures
-
Arkei Stealer Payload 2 IoCs
resource yara_rule behavioral1/memory/860-117-0x00000000007D0000-0x00000000007EC000-memory.dmp family_arkei behavioral1/memory/860-118-0x0000000000400000-0x000000000055F000-memory.dmp family_arkei -
Downloads MZ/PE file
-
Loads dropped DLL 3 IoCs
pid Process 860 16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe 860 16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe 860 16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2376 timeout.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 860 wrote to memory of 1488 860 16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe 69 PID 860 wrote to memory of 1488 860 16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe 69 PID 860 wrote to memory of 1488 860 16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe 69 PID 1488 wrote to memory of 2376 1488 cmd.exe 71 PID 1488 wrote to memory of 2376 1488 cmd.exe 71 PID 1488 wrote to memory of 2376 1488 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe"C:\Users\Admin\AppData\Local\Temp\16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\16ed57d6423603a522ba94bab37d92e3cf795420b929e6dcf9b4477f9ec79c04.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:2376
-
-