Resubmissions

19-01-2022 16:33

220119-t22cmabeh7 10

25-11-2021 12:38

211125-pt3hhaaee7 8

Analysis

  • max time kernel
    135s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    19-01-2022 16:33

General

  • Target

    c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe

  • Size

    5.0MB

  • MD5

    dbe9736b562b2bcce0b531fdfeaded32

  • SHA1

    a36ac4af321f97964885b801601aaee816f405d1

  • SHA256

    c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240

  • SHA512

    9dc69b482a510482b6aa6992924daf39b96bb43ab9017d6919120288e3d7936717b21aa24cd12c51d64d446eecc626bdc0ddfd0222cff5fde8010d110edea849

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://185.215.113.39/7vlcKuayFx.php

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

  • Babadeda Crypter 1 IoCs
  • Arkei Stealer Payload 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
    "C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Users\Admin\AppData\Local\Temp\is-6FDAK.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6FDAK.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$80182,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
        "C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Users\Admin\AppData\Local\Temp\is-H1ITM.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-H1ITM.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$9004C,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3824
          • C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
            "C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2244

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-6FDAK.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
    MD5

    19d3e925bd3944acf03a70e2da39e46f

    SHA1

    b7710e87fecbd6abf2d1e60cfdf4f524f184850a

    SHA256

    4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

    SHA512

    241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

  • C:\Users\Admin\AppData\Local\Temp\is-H1ITM.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp
    MD5

    19d3e925bd3944acf03a70e2da39e46f

    SHA1

    b7710e87fecbd6abf2d1e60cfdf4f524f184850a

    SHA256

    4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

    SHA512

    241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

  • C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
    MD5

    60c37f73b6d60884ad028ef1f026ddd7

    SHA1

    85409616ded051ccbe2a2854bc0c2be9a2166a14

    SHA256

    a7aa2196fdf652c469f5bbe4122f6bdddb6e3dd91a48e63181491f95fe102660

    SHA512

    cb4286729dc7e7fa901430ddd3f16e248372e94ad4a6e166ede1582e2486158c71b4c1bd4c8f4302622a308dda1caf46fbee5ec3c4f95fd7b4ea820a82f1a177

  • C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
    MD5

    60c37f73b6d60884ad028ef1f026ddd7

    SHA1

    85409616ded051ccbe2a2854bc0c2be9a2166a14

    SHA256

    a7aa2196fdf652c469f5bbe4122f6bdddb6e3dd91a48e63181491f95fe102660

    SHA512

    cb4286729dc7e7fa901430ddd3f16e248372e94ad4a6e166ede1582e2486158c71b4c1bd4c8f4302622a308dda1caf46fbee5ec3c4f95fd7b4ea820a82f1a177

  • C:\Users\Admin\AppData\Roaming\Ev Reports Management\swresample-1.dll
    MD5

    099e471203758f7653160a6f9f227d8d

    SHA1

    8246f4331f9aa47d2f9de96baafe2d1cf9bfa254

    SHA256

    eb9a87fc1b24a0e0476b34bfe4f22e0683f699bab9e7e50f42e3ae10c76c025b

    SHA512

    b7c7747277125ebc22ddc4f350212312ef6945a8f524b1f3088364c3c7b8618f480739c870037adc225c15db4887240b663c7e9d1657950171eba5ad76b3bbae

  • C:\Users\Admin\AppData\Roaming\Ev Reports Management\swresample-1.dll
    MD5

    099e471203758f7653160a6f9f227d8d

    SHA1

    8246f4331f9aa47d2f9de96baafe2d1cf9bfa254

    SHA256

    eb9a87fc1b24a0e0476b34bfe4f22e0683f699bab9e7e50f42e3ae10c76c025b

    SHA512

    b7c7747277125ebc22ddc4f350212312ef6945a8f524b1f3088364c3c7b8618f480739c870037adc225c15db4887240b663c7e9d1657950171eba5ad76b3bbae

  • C:\Users\Admin\AppData\Roaming\Ev Reports Management\ui
    MD5

    95518f5e98099572bede73302c79c7bd

    SHA1

    6168202123dca8fbc4a8e688561b5b18d51a462e

    SHA256

    115a380ecb81d1ddaa1c913c8ac6a1142400d22526ce979ed1a3d0a75ebf2e7a

    SHA512

    a0899e422b550498676b94aa9c9f59dfd5e0f6813e041f3e297698d5daa3501b186fc4a10e292f4ba445f7573d569f99a3916f4ee1f619df41492d4c2efee5e1

  • memory/1552-133-0x00000000008C0000-0x00000000008C1000-memory.dmp
    Filesize

    4KB

  • memory/1720-134-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB

  • memory/2244-143-0x0000000000400000-0x0000000000BBD000-memory.dmp
    Filesize

    7.7MB

  • memory/3480-130-0x0000000000400000-0x00000000004D8000-memory.dmp
    Filesize

    864KB

  • memory/3824-137-0x00000000008D0000-0x00000000008D1000-memory.dmp
    Filesize

    4KB