Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
17/01/2022, 09:38
Static task
static1
Behavioral task
behavioral1
Sample
b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe
Resource
win10-en-20211208
General
-
Target
b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe
-
Size
280KB
-
MD5
9072310d9896b5a4cf3c0ce04d53d0b7
-
SHA1
a7ac3f9cfd9c7f20973f7832cd2aae15fdc02c37
-
SHA256
b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5
-
SHA512
d53dd6b4651600c828616e298b5acdff1fa9a609f4a17000e4ed44e9cd63c9a4e898707c5c9ed4945ff989f319142eb582eaff7db6a327d1b347a8be62eba664
Malware Config
Extracted
arkei
homesteadr
http://homesteadr.link/ggate.php
Signatures
-
Arkei Stealer Payload 2 IoCs
resource yara_rule behavioral1/memory/3192-117-0x0000000000400000-0x00000000005D0000-memory.dmp family_arkei behavioral1/memory/3192-116-0x0000000000720000-0x000000000073C000-memory.dmp family_arkei -
Downloads MZ/PE file
-
Loads dropped DLL 3 IoCs
pid Process 3192 b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe 3192 b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe 3192 b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1784 timeout.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3192 wrote to memory of 3720 3192 b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe 69 PID 3192 wrote to memory of 3720 3192 b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe 69 PID 3192 wrote to memory of 3720 3192 b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe 69 PID 3720 wrote to memory of 1784 3720 cmd.exe 71 PID 3720 wrote to memory of 1784 3720 cmd.exe 71 PID 3720 wrote to memory of 1784 3720 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe"C:\Users\Admin\AppData\Local\Temp\b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\b0bbd786fb3429997e5c0f31e9c7692558bebf90e94b4cc64f03d5bc6c7e63f5.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1784
-
-