arkei | ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8

General

Target

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe
Size

522KB
MD5

82e2fb19440f6f3807094a3094240858
SHA1

1db001a081331504300c33afafb1a36428e6166d
SHA256

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8
SHA512

e9f7aba46904750997955e10f26c4de9eedd5b91c8ee82b12732acf88e8c07003ea4e2878ffc454fdbe298ad4be1e21685160fbd836bac898e51a3044123a155

Score

10^/10

Family

arkei

Botnet

Default

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Executes dropped EXE 1 IoCs

Processes:

WinSec.exe

pid process

4848 WinSec.exe

pid	process
4848	WinSec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

description	pid	process	target process
PID 2116 set thread context of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

description pid process

Token: SeDebugPrivilege 2116 ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

description	pid	process
Token: SeDebugPrivilege	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe

description	pid	process	target process
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe
PID 2116 wrote to memory of 4848	2116	ba4d691fccd7047d36318766d019732807f993f366c0caca600dc8ce6162d5c8.exe	WinSec.exe

C:\Users\Admin\AppData\Local\Temp\WinSec.exe
C:\Users\Admin\AppData\Local\Temp\WinSec.exe
2⤵
- Executes dropped EXE
PID:4848

C:\Users\Admin\AppData\Local\Temp\WinSec.exe
Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinSec.exe
Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/2116-130-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/2116-138-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/4848-131-0x0000000000000000-mapping.dmp

Download
memory/4848-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4848-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4848-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4848-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download