arkei | 3f0841eff18ab98e2614071d89619c1fb84e653cb1c524384801bdf00d7e9d42

General

Target

f3b2c0e21faa2d771b315cfda97a4c32.exe
Size

2.5MB
MD5

f3b2c0e21faa2d771b315cfda97a4c32
SHA1

806b920c7c0299ffa9fbe4c94825d0313381927f
SHA256

3f0841eff18ab98e2614071d89619c1fb84e653cb1c524384801bdf00d7e9d42
SHA512

6c0503c9523027ebc2c4363e2d3aef39c513316aaf69bdf5f660112a1f3f1371ca20d5f8f134485ee573076084592ace1bc5e1056c8d645e010bb6b2267b19b2

Score

10^/10

arkei default stealer

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://jsdkca.link/518855.php

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 1940	1312	f3b2c0e21faa2d771b315cfda97a4c32.exe	29

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1312	f3b2c0e21faa2d771b315cfda97a4c32.exe
1312	f3b2c0e21faa2d771b315cfda97a4c32.exe
1312	f3b2c0e21faa2d771b315cfda97a4c32.exe
1312	f3b2c0e21faa2d771b315cfda97a4c32.exe
1312	f3b2c0e21faa2d771b315cfda97a4c32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1312	f3b2c0e21faa2d771b315cfda97a4c32.exe
Token: SeIncBasePriorityPrivilege	1312	f3b2c0e21faa2d771b315cfda97a4c32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1940	1312	f3b2c0e21faa2d771b315cfda97a4c32.exe	29
PID 1312 wrote to memory of 1940	1312	f3b2c0e21faa2d771b315cfda97a4c32.exe	29
PID 1312 wrote to memory of 1940	1312	f3b2c0e21faa2d771b315cfda97a4c32.exe	29
PID 1312 wrote to memory of 1940	1312	f3b2c0e21faa2d771b315cfda97a4c32.exe	29
PID 1312 wrote to memory of 1940	1312	f3b2c0e21faa2d771b315cfda97a4c32.exe	29
PID 1312 wrote to memory of 1940	1312	f3b2c0e21faa2d771b315cfda97a4c32.exe	29

C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe
"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe
  "C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"
  2⤵
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-64-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1312-73-0x0000000000540000-0x00000000006A9000-memory.dmp

Filesize
1.4MB

Download
memory/1312-56-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download
memory/1312-58-0x0000000002B70000-0x0000000002B98000-memory.dmp

Filesize
160KB

Download
memory/1312-55-0x00000000007C0000-0x0000000000ACD000-memory.dmp

Filesize
3.1MB

Download
memory/1312-59-0x0000000000540000-0x00000000006A9000-memory.dmp

Filesize
1.4MB

Download
memory/1312-60-0x0000000000540000-0x00000000006A9000-memory.dmp

Filesize
1.4MB

Download
memory/1312-54-0x0000000000F70000-0x00000000013A1000-memory.dmp

Filesize
4.2MB

Download
memory/1312-62-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/1312-57-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/1312-61-0x0000000000F70000-0x00000000013A1000-memory.dmp

Filesize
4.2MB

Download
memory/1312-65-0x000000000D3A0000-0x000000000D69A000-memory.dmp

Filesize
3.0MB

Download
memory/1312-63-0x0000000000540000-0x00000000006A9000-memory.dmp

Filesize
1.4MB

Download
memory/1312-70-0x0000000000F70000-0x00000000013A1000-memory.dmp

Filesize
4.2MB

Download
memory/1940-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1940-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1940-72-0x0000000000F70000-0x00000000013A1000-memory.dmp

Filesize
4.2MB

Download
memory/1940-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1940-74-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1940-75-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing