Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17/01/2022, 09:34
Static task
static1
Behavioral task
behavioral1
Sample
MediaPlayer.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
MediaPlayer.exe
Resource
win10v2004-en-20220113
General
-
Target
MediaPlayer.exe
-
Size
280KB
-
MD5
9072310d9896b5a4cf3c0ce04d53d0b7
-
SHA1
a7ac3f9cfd9c7f20973f7832cd2aae15fdc02c37
-
SHA256
b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5
-
SHA512
d53dd6b4651600c828616e298b5acdff1fa9a609f4a17000e4ed44e9cd63c9a4e898707c5c9ed4945ff989f319142eb582eaff7db6a327d1b347a8be62eba664
Malware Config
Extracted
arkei
homesteadr
http://homesteadr.link/ggate.php
Signatures
-
Arkei Stealer Payload 2 IoCs
resource yara_rule behavioral1/memory/1684-55-0x0000000000400000-0x00000000005D0000-memory.dmp family_arkei behavioral1/memory/1684-54-0x0000000000240000-0x000000000025C000-memory.dmp family_arkei -
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 364 cmd.exe -
Loads dropped DLL 5 IoCs
pid Process 1684 MediaPlayer.exe 1684 MediaPlayer.exe 1684 MediaPlayer.exe 1684 MediaPlayer.exe 1684 MediaPlayer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MediaPlayer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MediaPlayer.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1740 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1684 wrote to memory of 364 1684 MediaPlayer.exe 29 PID 1684 wrote to memory of 364 1684 MediaPlayer.exe 29 PID 1684 wrote to memory of 364 1684 MediaPlayer.exe 29 PID 1684 wrote to memory of 364 1684 MediaPlayer.exe 29 PID 364 wrote to memory of 1740 364 cmd.exe 31 PID 364 wrote to memory of 1740 364 cmd.exe 31 PID 364 wrote to memory of 1740 364 cmd.exe 31 PID 364 wrote to memory of 1740 364 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\MediaPlayer.exe"C:\Users\Admin\AppData\Local\Temp\MediaPlayer.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\MediaPlayer.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1740
-
-