Analysis
-
max time kernel
112s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19/04/2022, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe
-
Size
272KB
-
MD5
0779bc5767383c361e5bacc71f537a38
-
SHA1
a6bfcddcfc212bbd607fda67507306ab12e46823
-
SHA256
aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e
-
SHA512
b4fed51cffc865b940d0f85261b79266626225ab83427074260d0d1fee1122402b8848ca74b0a6668266cfadede15361d0a32b4d610dd390d2fc82559c27fffb
Malware Config
Extracted
Family
arkei
Botnet
Default
C2
http://jsdkci.link/588711.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5088 set thread context of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79 -
Program crash 1 IoCs
pid pid_target Process procid_target 2836 3020 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5088 wrote to memory of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79 PID 5088 wrote to memory of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79 PID 5088 wrote to memory of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79 PID 5088 wrote to memory of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79 PID 5088 wrote to memory of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79 PID 5088 wrote to memory of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79 PID 5088 wrote to memory of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79 PID 5088 wrote to memory of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79 PID 5088 wrote to memory of 3020 5088 aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe"C:\Users\Admin\AppData\Local\Temp\aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe"C:\Users\Admin\AppData\Local\Temp\aedd3ab9ebad560ccd8f02129fd585ddeac9a9e921c9dbcb42beefb724bba10e.exe"2⤵PID:3020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 13283⤵
- Program crash
PID:2836
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3020 -ip 30201⤵PID:3992