arkei | df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731

General

Target

df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
Size

100KB
MD5

c7a310982da68b10360854f9cd78e718
SHA1

60140c28e0b7db797a771c2dee081fa3812246db
SHA256

df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731
SHA512

6747fa3f7637922eeaa0feeb25d430dc6ab66fd9f3d22e7e5fd16bad9b75528a8174c34a8baf681950b64e8cdaa6a14e37633592e843c363e75468622ebd2ec3

Score

10^/10

arkei default stealer suricata

Malware Config

Extracted

Family

arkei

Botnet

Default

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
suricata

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28
PID 1732 wrote to memory of 1688	1732	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	28

C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
"C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-66-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-61-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-71-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-70-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-58-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-59-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-63-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-67-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-64-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1732-54-0x0000000000960000-0x000000000097E000-memory.dmp

Filesize
120KB

Download
memory/1732-55-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/1732-57-0x0000000005070000-0x00000000050B8000-memory.dmp

Filesize
288KB

Download
memory/1732-56-0x0000000008850000-0x00000000089B4000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing