Analysis
- max time kernel
139s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
11/02/2022, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
577d894cb539916b5e50410aac17d8ca.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 577d894cb539916b5e50410aac17d8ca.exe
- Size 353KB
- Sample220211-wtqx2aefan
- SHA256 f938a7c0ebc32402cc6d0a2535eaac499468a2eadab4d38337fe6ddcce5eb7d2
- MD5 577d894cb539916b5e50410aac17d8ca
- SHA1 cd9c1e5ad52d3bdca36f4fb4ebfa0f370d03eae9
- SHA512 b7d54d08f9b53c2249bf42db566ac80889d9418dafdaa583c3aa2933af0c63f1de247ba9178c433eafffbccfb1137f7ae3676198606d493837d9b7d60c7fe635
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
arkei
Botnet
-
Dafault
C2
-
http://googa.link/gate1.php
Signatures
- Arkei Stealer Payload 2 IoCs
resource yara_rule behavioral2/memory/1664-132-0x0000000002B90000-0x0000000002BAF000-memory.dmp family_arkei behavioral2/memory/1664-133-0x0000000000400000-0x0000000000431000-memory.dmp family_arkei - Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 577d894cb539916b5e50410aac17d8ca.exe - Loads dropped DLL 3 IoCs
pid Process 1664 577d894cb539916b5e50410aac17d8ca.exe 1664 577d894cb539916b5e50410aac17d8ca.exe 1664 577d894cb539916b5e50410aac17d8ca.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 577d894cb539916b5e50410aac17d8ca.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 577d894cb539916b5e50410aac17d8ca.exe - Delays execution with timeout.exe 1 IoCs
pid Process 5036 timeout.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4792 svchost.exe Token: SeCreatePagefilePrivilege 4792 svchost.exe Token: SeShutdownPrivilege 4792 svchost.exe Token: SeCreatePagefilePrivilege 4792 svchost.exe Token: SeShutdownPrivilege 4792 svchost.exe Token: SeCreatePagefilePrivilege 4792 svchost.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe Token: SeRestorePrivilege 260 TiWorker.exe Token: SeSecurityPrivilege 260 TiWorker.exe Token: SeBackupPrivilege 260 TiWorker.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1664 wrote to memory of 3160 1664 577d894cb539916b5e50410aac17d8ca.exe 92 PID 1664 wrote to memory of 3160 1664 577d894cb539916b5e50410aac17d8ca.exe 92 PID 1664 wrote to memory of 3160 1664 577d894cb539916b5e50410aac17d8ca.exe 92 PID 3160 wrote to memory of 5036 3160 cmd.exe 94 PID 3160 wrote to memory of 5036 3160 cmd.exe 94 PID 3160 wrote to memory of 5036 3160 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\577d894cb539916b5e50410aac17d8ca.exe"C:\Users\Admin\AppData\Local\Temp\577d894cb539916b5e50410aac17d8ca.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\577d894cb539916b5e50410aac17d8ca.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:5036
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:260