arkei | c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240

Resubmissions

19-01-2022 16:33

220119-t22cmabeh7 10

25-11-2021 12:38

211125-pt3hhaaee7 8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
19-01-2022 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
Size

5.0MB
MD5

dbe9736b562b2bcce0b531fdfeaded32
SHA1

a36ac4af321f97964885b801601aaee816f405d1
SHA256

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240
SHA512

9dc69b482a510482b6aa6992924daf39b96bb43ab9017d6919120288e3d7936717b21aa24cd12c51d64d446eecc626bdc0ddfd0222cff5fde8010d110edea849

Score

10^/10

arkei babadeda default crypter loader stealer

Malware Config

Extracted

Family

arkei

Botnet

Default

http://185.215.113.39/7vlcKuayFx.php

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Ev Reports Management\ui	family_babadeda

Arkei Stealer Payload 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1460-76-0x0000000000400000-0x0000000000BBD000-memory.dmp	family_arkei

Executes dropped EXE 3 IoCs

Processes:

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmpc920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmpevreporter.exe

pid	process
1516	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
1412	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
1460	evreporter.exe

Loads dropped DLL 5 IoCs

Processes:

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exec920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exec920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmpevreporter.exe

pid	process
1704	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
668	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
1412	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
1412	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
1460	evreporter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

pid	process
1412	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
1412	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

pid process

1412 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exec920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmpc920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exec920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
"C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\is-GG09T.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GG09T.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$40108,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
    "C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:668
  - - C:\Users\Admin\AppData\Local\Temp\is-7A01Q.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7A01Q.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$50108,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
        
        "C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-7A01Q.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

MD5
19d3e925bd3944acf03a70e2da39e46f

SHA1
b7710e87fecbd6abf2d1e60cfdf4f524f184850a

SHA256
4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

SHA512
241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GG09T.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

MD5
19d3e925bd3944acf03a70e2da39e46f

SHA1
b7710e87fecbd6abf2d1e60cfdf4f524f184850a

SHA256
4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

SHA512
241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe

MD5
60c37f73b6d60884ad028ef1f026ddd7

SHA1
85409616ded051ccbe2a2854bc0c2be9a2166a14

SHA256
a7aa2196fdf652c469f5bbe4122f6bdddb6e3dd91a48e63181491f95fe102660

SHA512
cb4286729dc7e7fa901430ddd3f16e248372e94ad4a6e166ede1582e2486158c71b4c1bd4c8f4302622a308dda1caf46fbee5ec3c4f95fd7b4ea820a82f1a177

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\swresample-1.dll

MD5
099e471203758f7653160a6f9f227d8d

SHA1
8246f4331f9aa47d2f9de96baafe2d1cf9bfa254

SHA256
eb9a87fc1b24a0e0476b34bfe4f22e0683f699bab9e7e50f42e3ae10c76c025b

SHA512
b7c7747277125ebc22ddc4f350212312ef6945a8f524b1f3088364c3c7b8618f480739c870037adc225c15db4887240b663c7e9d1657950171eba5ad76b3bbae

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\ui

MD5
95518f5e98099572bede73302c79c7bd

SHA1
6168202123dca8fbc4a8e688561b5b18d51a462e

SHA256
115a380ecb81d1ddaa1c913c8ac6a1142400d22526ce979ed1a3d0a75ebf2e7a

SHA512
a0899e422b550498676b94aa9c9f59dfd5e0f6813e041f3e297698d5daa3501b186fc4a10e292f4ba445f7573d569f99a3916f4ee1f619df41492d4c2efee5e1

Download Submit
\Users\Admin\AppData\Local\Temp\is-7A01Q.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

MD5
19d3e925bd3944acf03a70e2da39e46f

SHA1
b7710e87fecbd6abf2d1e60cfdf4f524f184850a

SHA256
4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

SHA512
241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

Download Submit
\Users\Admin\AppData\Local\Temp\is-GG09T.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp

MD5
19d3e925bd3944acf03a70e2da39e46f

SHA1
b7710e87fecbd6abf2d1e60cfdf4f524f184850a

SHA256
4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

SHA512
241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

Download Submit
\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe

MD5
60c37f73b6d60884ad028ef1f026ddd7

SHA1
85409616ded051ccbe2a2854bc0c2be9a2166a14

SHA256
a7aa2196fdf652c469f5bbe4122f6bdddb6e3dd91a48e63181491f95fe102660

SHA512
cb4286729dc7e7fa901430ddd3f16e248372e94ad4a6e166ede1582e2486158c71b4c1bd4c8f4302622a308dda1caf46fbee5ec3c4f95fd7b4ea820a82f1a177

Download Submit
\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe

MD5
60c37f73b6d60884ad028ef1f026ddd7

SHA1
85409616ded051ccbe2a2854bc0c2be9a2166a14

SHA256
a7aa2196fdf652c469f5bbe4122f6bdddb6e3dd91a48e63181491f95fe102660

SHA512
cb4286729dc7e7fa901430ddd3f16e248372e94ad4a6e166ede1582e2486158c71b4c1bd4c8f4302622a308dda1caf46fbee5ec3c4f95fd7b4ea820a82f1a177

Download Submit
\Users\Admin\AppData\Roaming\Ev Reports Management\swresample-1.dll

MD5
099e471203758f7653160a6f9f227d8d

SHA1
8246f4331f9aa47d2f9de96baafe2d1cf9bfa254

SHA256
eb9a87fc1b24a0e0476b34bfe4f22e0683f699bab9e7e50f42e3ae10c76c025b

SHA512
b7c7747277125ebc22ddc4f350212312ef6945a8f524b1f3088364c3c7b8618f480739c870037adc225c15db4887240b663c7e9d1657950171eba5ad76b3bbae

Download Submit
memory/668-62-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1412-67-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1412-68-0x0000000074231000-0x0000000074233000-memory.dmp

Filesize
8KB

Download
memory/1460-76-0x0000000000400000-0x0000000000BBD000-memory.dmp

Filesize
7.7MB

Download
memory/1516-60-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1704-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1704-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download

description	pid	process	target process
PID 1704 wrote to memory of 1516	1704	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 1704 wrote to memory of 1516	1704	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 1704 wrote to memory of 1516	1704	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 1704 wrote to memory of 1516	1704	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 1704 wrote to memory of 1516	1704	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 1704 wrote to memory of 1516	1704	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 1704 wrote to memory of 1516	1704	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 1516 wrote to memory of 668	1516	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 1516 wrote to memory of 668	1516	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 1516 wrote to memory of 668	1516	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 1516 wrote to memory of 668	1516	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 1516 wrote to memory of 668	1516	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 1516 wrote to memory of 668	1516	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 1516 wrote to memory of 668	1516	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
PID 668 wrote to memory of 1412	668	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 668 wrote to memory of 1412	668	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 668 wrote to memory of 1412	668	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 668 wrote to memory of 1412	668	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 668 wrote to memory of 1412	668	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 668 wrote to memory of 1412	668	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 668 wrote to memory of 1412	668	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
PID 1412 wrote to memory of 1460	1412	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	evreporter.exe
PID 1412 wrote to memory of 1460	1412	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	evreporter.exe
PID 1412 wrote to memory of 1460	1412	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	evreporter.exe
PID 1412 wrote to memory of 1460	1412	c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp	evreporter.exe