arkei | 672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009

Analysis

max time kernel
215s
max time network
278s
platform
windows10_x64
resource
win10-20220414-en
submitted
21-06-2022 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
Size

1.1MB
MD5

c3f533c47a2f995cd4b5d16653698609
SHA1

223cfb523ff8b64b339a34db3808dc6a386752a4
SHA256

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009
SHA512

6f6635c7864f675f0f9dfe315c5a7aeef93da7ca91b6016eed8506b7e1c809de8031f9659f87339f58e807a6d59b83214896af5ba71659b0b9e50511a1c91761

Score

10^/10

arkei recordbreaker default stealer

Malware Config

Extracted

Family

recordbreaker

http://192.248.184.34/

http://140.82.52.55/

Extracted

Family

arkei

Botnet

Default

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei

Raccoon ver2 2 IoCs

Raccoon ver2.

Processes:

resource	yara_rule
behavioral2/memory/344-211-0x0000000000400000-0x0000000000412000-memory.dmp	raccoon_v2
behavioral2/memory/344-280-0x0000000000400000-0x0000000000412000-memory.dmp	raccoon_v2

RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
stealer recordbreaker
Executes dropped EXE 2 IoCs

Processes:

dhgerme.exedhgerme.exe

pid process

2888 dhgerme.exe
2136 dhgerme.exe

pid	process
2888	dhgerme.exe
2136	dhgerme.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exedhgerme.exe

description	pid	process	target process
PID 912 set thread context of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 2888 set thread context of 2136	2888	dhgerme.exe	dhgerme.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1988 2136 WerFault.exe dhgerme.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exedhgerme.exe

pid process

912 672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
2888 dhgerme.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exedhgerme.exe

pid process

912 672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
2888 dhgerme.exe

pid	pid_target	process	target process
1988	2136	WerFault.exe	dhgerme.exe

pid	process
912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
2888	dhgerme.exe

pid	process
912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
2888	dhgerme.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exedhgerme.exe

description	pid	process	target process
PID 912 wrote to memory of 2888	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	dhgerme.exe
PID 912 wrote to memory of 2888	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	dhgerme.exe
PID 912 wrote to memory of 2888	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	dhgerme.exe
PID 912 wrote to memory of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 912 wrote to memory of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 912 wrote to memory of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 912 wrote to memory of 344	912	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe	672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
PID 2888 wrote to memory of 2136	2888	dhgerme.exe	dhgerme.exe
PID 2888 wrote to memory of 2136	2888	dhgerme.exe	dhgerme.exe
PID 2888 wrote to memory of 2136	2888	dhgerme.exe	dhgerme.exe
PID 2888 wrote to memory of 2136	2888	dhgerme.exe	dhgerme.exe

C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
"C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
"C:\Users\Admin\AppData\Local\Temp\dhgerme.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888

C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
"C:\Users\Admin\AppData\Local\Temp\dhgerme.exe"
3⤵
- Executes dropped EXE
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 1180
4⤵
- Program crash
PID:1988

C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe
"C:\Users\Admin\AppData\Local\Temp\672fea64c92edc4d937d3132577b65813738bfddeab6a6b3ef35e6fa4b987009.exe"
2⤵
PID:344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dhgerme.exe
Filesize
636KB

MD5
3db09f87da90c69511e1e8b27adac692

SHA1
f07109e4e9e46467022d45cf12c79f4ead85e0b6

SHA256
e7d98b927978c0b948f863f504a1a0e950c7261e895edb0332aedcdcf40b7132

SHA512
d301617a3f4c54e4698714243f8701ae462d5178c607f2550e03eb8f50be749c6c74a43037fb29a58e9b5853154c558f0884d74176f999bbe22518156055040a

Download Submit
memory/344-171-0x0000000000407486-mapping.dmp

Download
memory/344-172-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-182-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-280-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/344-211-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/344-175-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-176-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-180-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/344-186-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-152-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-156-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-126-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-127-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-128-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-129-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-130-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-131-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-132-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-133-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-134-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-135-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-136-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-137-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-138-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-139-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-140-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-141-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-142-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-143-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-145-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-146-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-148-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-149-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-150-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-151-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-124-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-153-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-154-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-155-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-157-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-125-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-158-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-159-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-160-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-161-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-162-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-163-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-164-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-165-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-166-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-179-0x0000000002BE0000-0x0000000002BE7000-memory.dmp

Filesize
28KB

Download
memory/912-116-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-117-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-118-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-119-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-120-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-121-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-122-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/912-123-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2136-250-0x000000000043C0B2-mapping.dmp

Download
memory/2136-322-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2136-281-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2136-263-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2888-181-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-174-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-170-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-173-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-169-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-177-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-185-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-167-0x0000000000000000-mapping.dmp

Download
memory/2888-178-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download
memory/2888-184-0x00000000779D0000-0x0000000077B5E000-memory.dmp

Filesize
1.6MB

Download