arkei | 672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009

Analysis

max time kernel
215s
max time network
278s
platform
windows10_x64
resource
win10-20220414-en
submitted
21/06/2022, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
Size

1.1MB
MD5

c3f533c47a2f995cd4b5d16653698609
SHA1

223cfb523ff8b64b339a34db3808dc6a386752a4
SHA256

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009
SHA512

6f6635c7864f675f0f9dfe315c5a7aeef93da7ca91b6016eed8506b7e1c809de8031f9659f87339f58e807a6d59b83214896af5ba71659b0b9e50511a1c91761

Score

10^/10

arkei recordbreaker default stealer

Malware Config

Extracted

Family

recordbreaker

http://192.248.184.34/

http://140.82.52.55/

Extracted

Family

arkei

Botnet

Default

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei

Raccoon ver2 2 IoCs

Raccoon ver2.

resource	yara_rule
behavioral2/memory/344-211-0x0000000000400000-0x0000000000412000-memory.dmp	raccoon_v2
behavioral2/memory/344-280-0x0000000000400000-0x0000000000412000-memory.dmp	raccoon_v2

RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
stealer recordbreaker

Executes dropped EXE 2 IoCs

pid	Process
2888	dhgerme.exe
2136	dhgerme.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 912 set thread context of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	67
PID 2888 set thread context of 2136	2888	dhgerme.exe	68

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2136	WerFault.exe	68

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
2888	dhgerme.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
2888	dhgerme.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2888	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	66
PID 912 wrote to memory of 2888	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	66
PID 912 wrote to memory of 2888	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	66
PID 912 wrote to memory of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	67
PID 912 wrote to memory of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	67
PID 912 wrote to memory of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	67
PID 912 wrote to memory of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	67
PID 2888 wrote to memory of 2136	2888	dhgerme.exe	68
PID 2888 wrote to memory of 2136	2888	dhgerme.exe	68
PID 2888 wrote to memory of 2136	2888	dhgerme.exe	68
PID 2888 wrote to memory of 2136	2888	dhgerme.exe	68

C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
"C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
  "C:\Users\Admin\AppData\Local\Temp\dhgerme.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
    "C:\Users\Admin\AppData\Local\Temp\dhgerme.exe"
    3⤵
    - Executes dropped EXE
    PID:2136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 1180
      4⤵
      Program crash
      PID:1988
- C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
  "C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe"
  2⤵
  PID:344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhgerme.exe

Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
memory/344-172-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-182-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-280-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/344-211-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/344-175-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-176-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-180-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-186-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-152-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-156-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-126-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-127-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-128-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-129-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-130-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-131-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-132-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-133-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-134-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-135-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-136-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-137-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-138-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-139-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-140-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-141-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-142-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-143-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-145-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-146-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-148-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-149-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-150-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-151-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-124-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-153-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-154-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-155-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-157-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-125-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-158-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-159-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-160-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-161-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-162-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-163-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-164-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-165-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-166-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-179-0x0000000002BE0000-0x0000000002BE7000-memory.dmp

Filesize
28KB

Download
memory/912-116-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-117-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-118-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-119-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-120-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-121-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-122-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-123-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2136-322-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2136-281-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2136-263-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2888-181-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-174-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-170-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-173-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-169-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-177-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-185-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-178-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-184-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads