Overview

overview

10

Static

static

5

23228cc73f...39.exe

windows7_x64

10

23228cc73f...39.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    125s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16/05/2022, 01:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    23228cc73fc7530de43ee9ec1253e6fda84ecd660f899fcad3755e7149cc4e39.exe
  • Size 1.0MB
  • Sample220516-ccfwyshef5
  • SHA256 23228cc73fc7530de43ee9ec1253e6fda84ecd660f899fcad3755e7149cc4e39
  • MD5 SHA1 SHA512
Score
10/10
arcaneratspywarestealer

Malware Config

Signatures

  • Arcane log file 1 IoCs

    Detects a log file produced by the Arcane Stealer.

  • ArcaneStealer

    Arcane Stealer is a .Net information-stealing malware that is easy to acquire in the dark web.

    ratstealerarcane
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23228cc73fc7530de43ee9ec1253e6fda84ecd660f899fcad3755e7149cc4e39.exe
    "C:\Users\Admin\AppData\Local\Temp\23228cc73fc7530de43ee9ec1253e6fda84ecd660f899fcad3755e7149cc4e39.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4948

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/4948-131-0x0000000000400000-0x0000000000412000-memory.dmp
        Download

        memory/4948-136-0x0000000005AF0000-0x0000000006094000-memory.dmp
        Download

        memory/4948-137-0x0000000005540000-0x00000000055D2000-memory.dmp
        Download

        memory/4948-138-0x0000000005A00000-0x0000000005A66000-memory.dmp
        Download

        memory/4948-139-0x0000000006B80000-0x0000000006B8A000-memory.dmp
        Download

        memory/4948-140-0x0000000006BB0000-0x0000000006BC2000-memory.dmp
        Download