arkei | ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8

General

Target

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe
Size

522KB
MD5

82e2fb19440f6f3807094a3094240858
SHA1

1db001a081331504300c33afafb1a36428e6166d
SHA256

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8
SHA512

e9f7aba46904750997955e10f26c4de9eedd5b91c8ee82b12732acf88e8c07003ea4e2878ffc454fdbe298ad4be1e21685160fbd836bac898e51a3044123a155

Score

10^/10

arkei default stealer

Malware Config

Extracted

Family

arkei

Botnet

Default

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Executes dropped EXE 1 IoCs

Processes:

WinSec.exe

pid process

860 WinSec.exe
Loads dropped DLL 3 IoCs

Processes:

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exeWinSec.exe

pid process

1796 ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe
860 WinSec.exe
860 WinSec.exe

pid	process
860	WinSec.exe

pid	process
1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe
860	WinSec.exe
860	WinSec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

description	pid	process	target process
PID 1796 set thread context of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

description pid process

Token: SeDebugPrivilege 1796 ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

description	pid	process
Token: SeDebugPrivilege	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

description	pid	process	target process
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 1796 wrote to memory of 860	1796	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe

C:\Users\Admin\AppData\Local\Temp\ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe
"C:\Users\Admin\AppData\Local\Temp\ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\WinSec.exe
C:\Users\Admin\AppData\Local\Temp\WinSec.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WinSec.exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinSec.exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Local\Temp\WinSec.exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Local\Temp\WinSec.exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Local\Temp\WinSec.exe
Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
memory/860-59-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-62-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-65-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-66-0x000000000042E084-mapping.dmp

Download
memory/860-61-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-69-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-75-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-76-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1796-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1796-74-0x0000000074C20000-0x00000000751CB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing