Overview

overview

10

Static

static

84ce6ef40fe457...fb.exe

windows7_x64

10

84ce6ef40fe457...fb.exe

windows10_x64

10
General
Target

84ce6ef40fe45773f5736d908eb40bfb.exe

Filesize

282KB

Completed

24-01-2022 07:04

Task

behavioral1

Score
10/10
MD5

84ce6ef40fe45773f5736d908eb40bfb

SHA1

52c98fe3b2f1a87dd3cdd541c202bed110f77925

SHA256

7ecb28ae735634d4a54bc4c04b9ee2fea9c28d964248d179b5277aff050da83d

SHA256

ec83c9f24604fd2b8ea145a3c92d8625aaee07751ec85f005013da8bd11322d73bf5fa83a620fb49c0463c937c63aa7406542a87df3b4eb9473e6f2079322965

Malware Config

Extracted

Family

arkei
Botnet

Default
C2

http://homesteadr.link/ggate.php
Signatures 2

Filter: none

  • Arkei

    Description

    Arkei is an infostealer written in C++.

    Tags

  • Arkei Stealer Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1308-55-0x0000000000240000-0x000000000025C000-memory.dmpfamily_arkei
    behavioral1/memory/1308-56-0x0000000000400000-0x000000000044E000-memory.dmpfamily_arkei
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\84ce6ef40fe45773f5736d908eb40bfb.exe
    "C:\Users\Admin\AppData\Local\Temp\84ce6ef40fe45773f5736d908eb40bfb.exe"
    PID:1308
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads

                          • memory/1308-54-0x0000000000220000-0x0000000000231000-memory.dmp

                            Download

                          • memory/1308-55-0x0000000000240000-0x000000000025C000-memory.dmp

                            Download

                          • memory/1308-56-0x0000000000400000-0x000000000044E000-memory.dmp

                            Download

                          • memory/1308-57-0x0000000076071000-0x0000000076073000-memory.dmp

                            Download