arkei | 672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009

Analysis

max time kernel
245s
max time network
240s
platform
windows7_x64
resource
win7-20220414-en
submitted
21/06/2022, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
Size

1.1MB
MD5

c3f533c47a2f995cd4b5d16653698609
SHA1

223cfb523ff8b64b339a34db3808dc6a386752a4
SHA256

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009
SHA512

6f6635c7864f675f0f9dfe315c5a7aeef93da7ca91b6016eed8506b7e1c809de8031f9659f87339f58e807a6d59b83214896af5ba71659b0b9e50511a1c91761

Score

10^/10

arkei recordbreaker default stealer

Malware Config

Extracted

Family

recordbreaker

http://192.248.184.34/

http://140.82.52.55/

Extracted

Family

arkei

Botnet

Default

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei

Raccoon ver2 1 IoCs

Raccoon ver2.

resource	yara_rule
behavioral1/memory/1532-72-0x0000000000400000-0x0000000000412000-memory.dmp	raccoon_v2

RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
stealer recordbreaker

Executes dropped EXE 2 IoCs

pid	Process
1980	dhgerme.exe
1228	dhgerme.exe

Loads dropped DLL 10 IoCs

pid	Process
1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
1980	dhgerme.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1512 set thread context of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	29
PID 1980 set thread context of 1228	1980	dhgerme.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1228	WerFault.exe	30

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
1980	dhgerme.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
1980	dhgerme.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1980	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	28
PID 1512 wrote to memory of 1980	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	28
PID 1512 wrote to memory of 1980	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	28
PID 1512 wrote to memory of 1980	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	28
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	29
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	29
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	29
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	29
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	29
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	30
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	30
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	30
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	30
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	30
PID 1228 wrote to memory of 1648	1228	dhgerme.exe	36
PID 1228 wrote to memory of 1648	1228	dhgerme.exe	36
PID 1228 wrote to memory of 1648	1228	dhgerme.exe	36
PID 1228 wrote to memory of 1648	1228	dhgerme.exe	36

C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
"C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
  "C:\Users\Admin\AppData\Local\Temp\dhgerme.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
    "C:\Users\Admin\AppData\Local\Temp\dhgerme.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 712
      4⤵
      Loads dropped DLL
      Program crash
      PID:1648
- C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
  "C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe"
  2⤵
  PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
memory/1228-74-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1228-71-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1512-56-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download
memory/1512-66-0x0000000001F10000-0x0000000001F17000-memory.dmp

Filesize
28KB

Download
memory/1532-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads