Analysis
-
max time kernel
4265058s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
16-01-2022 18:26
Static task
static1
General
-
Target
e7ff308afaaf87a6a7393e6f72aa6c8aa50b14348e9e3e416f1432e0e78dc52a.exe
-
Size
276KB
-
MD5
1cf165219b007cdd28abc0461e57c88c
-
SHA1
fb21ad6108a07707010e2b95b8b0368259fad956
-
SHA256
e7ff308afaaf87a6a7393e6f72aa6c8aa50b14348e9e3e416f1432e0e78dc52a
-
SHA512
37e4b0074349daa17b16e01c65f9e62ffc459e1b06eb56a37a329be585e52f9aae7a8e1d67d839482a699383c8d03dc62aa9e1ff458f56e977109bb97fed0a77
Malware Config
Extracted
Family
arkei
Botnet
Default
C2
http://file-file-host4.com/tratata.php
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1976 created 1900 1976 WerFault.exe e7ff308afaaf87a6a7393e6f72aa6c8aa50b14348e9e3e416f1432e0e78dc52a.exe -
Arkei Stealer Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-132-0x0000000000400000-0x00000000004DA000-memory.dmp family_arkei behavioral1/memory/1900-131-0x0000000002210000-0x000000000222C000-memory.dmp family_arkei -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3420 1900 WerFault.exe e7ff308afaaf87a6a7393e6f72aa6c8aa50b14348e9e3e416f1432e0e78dc52a.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotification.exeWerFault.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotification.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotification.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
WerFault.exepid process 3420 WerFault.exe 3420 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
MusNotification.exeWerFault.exedescription pid process Token: SeShutdownPrivilege 516 MusNotification.exe Token: SeCreatePagefilePrivilege 516 MusNotification.exe Token: SeRestorePrivilege 3420 WerFault.exe Token: SeBackupPrivilege 3420 WerFault.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WerFault.exedescription pid process target process PID 1976 wrote to memory of 1900 1976 WerFault.exe e7ff308afaaf87a6a7393e6f72aa6c8aa50b14348e9e3e416f1432e0e78dc52a.exe PID 1976 wrote to memory of 1900 1976 WerFault.exe e7ff308afaaf87a6a7393e6f72aa6c8aa50b14348e9e3e416f1432e0e78dc52a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7ff308afaaf87a6a7393e6f72aa6c8aa50b14348e9e3e416f1432e0e78dc52a.exe"C:\Users\Admin\AppData\Local\Temp\e7ff308afaaf87a6a7393e6f72aa6c8aa50b14348e9e3e416f1432e0e78dc52a.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 5562⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1900 -ip 19001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory