arkei | 672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009

Analysis

max time kernel
245s
max time network
240s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-06-2022 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
Size

1.1MB
MD5

c3f533c47a2f995cd4b5d16653698609
SHA1

223cfb523ff8b64b339a34db3808dc6a386752a4
SHA256

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009
SHA512

6f6635c7864f675f0f9dfe315c5a7aeef93da7ca91b6016eed8506b7e1c809de8031f9659f87339f58e807a6d59b83214896af5ba71659b0b9e50511a1c91761

Score

10^/10

arkei recordbreaker default stealer

Malware Config

Extracted

Family

recordbreaker

http://192.248.184.34/

http://140.82.52.55/

Extracted

Family

arkei

Botnet

Default

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei

Raccoon ver2 1 IoCs

Raccoon ver2.

Processes:

resource	yara_rule
behavioral1/memory/1532-72-0x0000000000400000-0x0000000000412000-memory.dmp	raccoon_v2

RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
stealer recordbreaker
Executes dropped EXE 2 IoCs

Processes:

dhgerme.exedhgerme.exe

pid process

1980 dhgerme.exe
1228 dhgerme.exe

pid	process
1980	dhgerme.exe
1228	dhgerme.exe

Loads dropped DLL 10 IoCs

Processes:

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exedhgerme.exeWerFault.exe

pid	process
1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
1980	dhgerme.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe
1648	WerFault.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exedhgerme.exe

description	pid	process	target process
PID 1512 set thread context of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 1980 set thread context of 1228	1980	dhgerme.exe	dhgerme.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1648 1228 WerFault.exe dhgerme.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exedhgerme.exe

pid process

1512 672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
1980 dhgerme.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exedhgerme.exe

pid process

1512 672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
1980 dhgerme.exe

pid	pid_target	process	target process
1648	1228	WerFault.exe	dhgerme.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exedhgerme.exedhgerme.exe

description	pid	process	target process
PID 1512 wrote to memory of 1980	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	dhgerme.exe
PID 1512 wrote to memory of 1980	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	dhgerme.exe
PID 1512 wrote to memory of 1980	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	dhgerme.exe
PID 1512 wrote to memory of 1980	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	dhgerme.exe
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 1512 wrote to memory of 1532	1512	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	dhgerme.exe
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	dhgerme.exe
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	dhgerme.exe
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	dhgerme.exe
PID 1980 wrote to memory of 1228	1980	dhgerme.exe	dhgerme.exe
PID 1228 wrote to memory of 1648	1228	dhgerme.exe	WerFault.exe
PID 1228 wrote to memory of 1648	1228	dhgerme.exe	WerFault.exe
PID 1228 wrote to memory of 1648	1228	dhgerme.exe	WerFault.exe
PID 1228 wrote to memory of 1648	1228	dhgerme.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
"C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512

C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
"C:\Users\Admin\AppData\Local\Temp\dhgerme.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980

C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
"C:\Users\Admin\AppData\Local\Temp\dhgerme.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 712
4⤵
- Loads dropped DLL
- Program crash
PID:1648

C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
"C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe"
2⤵
PID:1532

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
memory/1228-74-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1228-69-0x000000000043C0B2-mapping.dmp

Download
memory/1228-71-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1512-56-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download
memory/1512-66-0x0000000001F10000-0x0000000001F17000-memory.dmp

Filesize
28KB

Download
memory/1532-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1532-64-0x0000000000407486-mapping.dmp

Download
memory/1648-75-0x0000000000000000-mapping.dmp

Download
memory/1980-59-0x0000000000000000-mapping.dmp

Download