General

  • Target

    tj3wqx.dotm_

  • Size

    16KB

  • Sample

    220506-fhvh3sbhgr

  • MD5

    bb69e2f6d28afff89c9e43572cbccbcf

  • SHA1

    54001862cddf92bdfed74e9ccc78c6e165f9fd6a

  • SHA256

    b9a1ac0335226386029bb3b6f9f3b9114bde55c7ea9f4fdcdccc02593208bdfd

  • SHA512

    2e1c57e189a2ba0a1f57a223d7364ba43826b17f09a2b4e1b712874e5e1aed96dc423e97abf1b90f69cce0f115867c21452f23634f8f0a8c0804bf9608cad01b

Malware Config

Extracted

Family

arkei

Botnet

Default

Targets

    • Target

      tj3wqx.dotm_

    • Size

      16KB

    • MD5

      bb69e2f6d28afff89c9e43572cbccbcf

    • SHA1

      54001862cddf92bdfed74e9ccc78c6e165f9fd6a

    • SHA256

      b9a1ac0335226386029bb3b6f9f3b9114bde55c7ea9f4fdcdccc02593208bdfd

    • SHA512

      2e1c57e189a2ba0a1f57a223d7364ba43826b17f09a2b4e1b712874e5e1aed96dc423e97abf1b90f69cce0f115867c21452f23634f8f0a8c0804bf9608cad01b

    • Arkei

      Arkei is an infostealer written in C++.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

      suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks