arkei | 74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c

General

Target

74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe
Size

1.7MB
MD5

2b2ec30a2bf1c7166055e754a04c6ecf
SHA1

c4d2b04eab134dd058994633765410d9aefbe837
SHA256

74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c
SHA512

18642acdb1231b79112f66b06e47dee922eae4ed89a9cb00227e636833e76416023efd54c2e2728fe179659e796844fb545168248811fc2e823dc38e78e96f3e

Score

10^/10

arkei default spyware stealer

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://37.252.15.126/dhbUc2MgYS.php

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei

Arkei Stealer Payload 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/676-116-0x0000000000370000-0x000000000050D000-memory.dmp	family_arkei
behavioral1/memory/676-117-0x0000000000370000-0x000000000050D000-memory.dmp	family_arkei

Downloads MZ/PE file

Loads dropped DLL 3 IoCs

Processes:

74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe

pid	process
676	74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe
676	74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe
676	74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe

pid process

676 74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2444 676 WerFault.exe 74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe

pid	pid_target	process	target process
2444	676	WerFault.exe	74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exeWerFault.exe

pid	process
676	74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe
676	74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe
2444	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2444 WerFault.exe
Token: SeBackupPrivilege 2444 WerFault.exe
Token: SeDebugPrivilege 2444 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	2444	WerFault.exe
Token: SeBackupPrivilege	2444	WerFault.exe
Token: SeDebugPrivilege	2444	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe
"C:\Users\Admin\AppData\Local\Temp\74fad8e9b1a82d813dd72fce23abdc2d3819496750910c6cdcd70d7398831e2c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 1264
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\ProgramData\sqlite3.dll
MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
memory/676-115-0x0000000000370000-0x000000000050D000-memory.dmp

Filesize
1.6MB

Download
memory/676-116-0x0000000000370000-0x000000000050D000-memory.dmp

Filesize
1.6MB

Download
memory/676-117-0x0000000000370000-0x000000000050D000-memory.dmp

Filesize
1.6MB

Download
memory/676-118-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/676-119-0x0000000076E40000-0x0000000077002000-memory.dmp

Filesize
1.8MB

Download
memory/676-120-0x00000000027A0000-0x00000000027E6000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads