Analysis
-
max time kernel
48s -
max time network
48s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 15:42
Static task
static1
Behavioral task
behavioral1
Sample
adc5d511e576888aaed5f7e13b6df04f1b733e034bf34344be1dc0e6286dc5a0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
adc5d511e576888aaed5f7e13b6df04f1b733e034bf34344be1dc0e6286dc5a0.exe
Resource
win10-en-20211208
General
-
Target
adc5d511e576888aaed5f7e13b6df04f1b733e034bf34344be1dc0e6286dc5a0.exe
-
Size
350KB
-
MD5
b55890d016a3e0c6e7f4ba2e49ab7e43
-
SHA1
8e1565a321d0630957bc65e0bdaae59b6a3671b7
-
SHA256
adc5d511e576888aaed5f7e13b6df04f1b733e034bf34344be1dc0e6286dc5a0
-
SHA512
42876920445bccf5d32cb2be28ac546dd45cbce0ef1616b1800f5cd97a93c47bd27eafb619ccbab82b38a3707019210101fd989b20615c2f247c762671904f50
Malware Config
Extracted
arkei
Default
http://coin-file-file-19.com/tratata.php
Signatures
-
Arkei Stealer Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1452-54-0x0000000000220000-0x000000000023C000-memory.dmp family_arkei behavioral1/memory/1452-55-0x0000000000400000-0x000000000045F000-memory.dmp family_arkei -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
adc5d511e576888aaed5f7e13b6df04f1b733e034bf34344be1dc0e6286dc5a0.exepid process 1452 adc5d511e576888aaed5f7e13b6df04f1b733e034bf34344be1dc0e6286dc5a0.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\sqlite3.dllMD5
e477a96c8f2b18d6b5c27bde49c990bf
SHA1e980c9bf41330d1e5bd04556db4646a0210f7409
SHA25616574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
SHA512335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c
-
memory/1452-53-0x0000000000020000-0x0000000000031000-memory.dmpFilesize
68KB
-
memory/1452-54-0x0000000000220000-0x000000000023C000-memory.dmpFilesize
112KB
-
memory/1452-55-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1452-56-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB