arkei | df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731

General

Target
df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
Size 100KB
Sample220523-jnm8qsffcm
SHA256 df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731
MD5 c7a310982da68b10360854f9cd78e718
SHA1 60140c28e0b7db797a771c2dee081fa3812246db
SHA512 6747fa3f7637922eeaa0feeb25d430dc6ab66fd9f3d22e7e5fd16bad9b75528a8174c34a8baf681950b64e8cdaa6a14e37633592e843c363e75468622ebd2ec3
MD5 SHA1 SHA512

Score

10^/10

arkei default stealer suricata

Malware Config

Extracted

Family

arkei

Botnet

Default

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4
suricata

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79
PID 1684 wrote to memory of 4216	1684	df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe	79

C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe
"C:\Users\Admin\AppData\Local\Temp\df4876573295b4e7beb618db31a015ea617f61b811978bb168d432c4052f7731.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  PID:4216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-130-0x00000000005F0000-0x000000000060E000-memory.dmp

Download

memory/1684-131-0x0000000005550000-0x0000000005AF4000-memory.dmp

Download

memory/1684-132-0x0000000005040000-0x00000000050D2000-memory.dmp

Download

memory/1684-133-0x0000000004FC0000-0x0000000004FCA000-memory.dmp

Download

memory/4216-135-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4216-137-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4216-138-0x0000000000400000-0x000000000043D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads