arkei | 81bc6e0cf586a808ef3ee9c5ace20622f414853a8606007357104c39f5fa5693

Analysis

max time kernel
4265063s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
15-01-2022 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81bc6e0cf586a808ef3ee9c5ace20622f414853a8606007357104c39f5fa5693.exe
Size

316KB
MD5

bfa2ac832261df46640df025737b8c4a
SHA1

d7922ef0cef7cc4f7ce9df47ba4de6c9822f14a9
SHA256

81bc6e0cf586a808ef3ee9c5ace20622f414853a8606007357104c39f5fa5693
SHA512

097cd3a632d90ecc95531c467b5460aa48d397887c17838ad17a53b7a1162cf3b78c45e978a030d637aef98fcf50444baf4fbef35c8501f8b6e5885b1f50bea9

Score

10^/10

arkei default stealer

Malware Config

Extracted

Family

arkei

Botnet

Default

http://209.209.115.111/SYiQ6N1zUJ.php

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei

Arkei Stealer Payload 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/4072-131-0x0000000000620000-0x000000000063C000-memory.dmp	family_arkei
behavioral1/memory/4072-132-0x0000000000400000-0x000000000055F000-memory.dmp	family_arkei

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotification.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

MusNotification.exe

description pid process

Token: SeShutdownPrivilege 3256 MusNotification.exe
Token: SeCreatePagefilePrivilege 3256 MusNotification.exe

description	pid	process
Token: SeShutdownPrivilege	3256	MusNotification.exe
Token: SeCreatePagefilePrivilege	3256	MusNotification.exe

C:\Users\Admin\AppData\Local\Temp\81bc6e0cf586a808ef3ee9c5ace20622f414853a8606007357104c39f5fa5693.exe
"C:\Users\Admin\AppData\Local\Temp\81bc6e0cf586a808ef3ee9c5ace20622f414853a8606007357104c39f5fa5693.exe"
1⤵
PID:4072

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-130-0x000000000066E000-0x000000000067F000-memory.dmp

Filesize
68KB

Download
memory/4072-131-0x0000000000620000-0x000000000063C000-memory.dmp

Filesize
112KB

Download
memory/4072-132-0x0000000000400000-0x000000000055F000-memory.dmp

Filesize
1.4MB

Download