arkei | df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731

General

Target

df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
Size

100KB
MD5

c7a310982da68b10360854f9cd78e718
SHA1

60140c28e0b7db797a771c2dee081fa3812246db
SHA256

df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731
SHA512

6747fa3f7637922eeaa0feeb25d430dc6ab66fd9f3d22e7e5fd16bad9b75528a8174c34a8baf681950b64e8cdaa6a14e37633592e843c363e75468622ebd2ec3

Score

10^/10

arkei default stealer suricata

Malware Config

Extracted

Family

arkei

Botnet

Default

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
suricata

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1360 wrote to memory of 316	1360	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28

C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
"C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  PID:316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-67-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/316-63-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/316-71-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/316-66-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/316-58-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/316-59-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/316-64-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/316-61-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/316-70-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1360-54-0x00000000003F0000-0x000000000040E000-memory.dmp

Filesize
120KB

Download
memory/1360-55-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/1360-57-0x0000000004900000-0x0000000004948000-memory.dmp

Filesize
288KB

Download
memory/1360-56-0x0000000008670000-0x00000000087D4000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing