Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    17/01/2022, 10:04

General

  • Target

    15ba5bae9ec4325f142543ee5c62e68e12e45a46228dcd3fbd1ec046a3a078b9.exe

  • Size

    280KB

  • MD5

    44c86fdc1da2a5e7d2d34ceed689a07d

  • SHA1

    57c3e0cac8c0ea2ebd380b1c1636b0dd5b03687e

  • SHA256

    15ba5bae9ec4325f142543ee5c62e68e12e45a46228dcd3fbd1ec046a3a078b9

  • SHA512

    3b3587603e0ac03b8cd3ace390624d17c61f55cf48ac17e526f6f72b42a9b1eea7f6ab766fc1dd6b9a15342eda20cb2e95fd5492caf40b9b718a3f2629b917ce

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Arkei Stealer Payload 1 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15ba5bae9ec4325f142543ee5c62e68e12e45a46228dcd3fbd1ec046a3a078b9.exe
    "C:\Users\Admin\AppData\Local\Temp\15ba5bae9ec4325f142543ee5c62e68e12e45a46228dcd3fbd1ec046a3a078b9.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:528
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\15ba5bae9ec4325f142543ee5c62e68e12e45a46228dcd3fbd1ec046a3a078b9.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:3392

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/528-117-0x0000000000710000-0x000000000085A000-memory.dmp

          Filesize

          1.3MB

        • memory/528-118-0x0000000000400000-0x00000000005D0000-memory.dmp

          Filesize

          1.8MB