arkei | dded864374fbbe8528eb7dd1b6d02f108949680dc6778ddb186387b93df2bfd0 | Triage

Analysis

max time kernel
84s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 14:10

Sharing

Report Analysis Logs

General

Target

1988-54-0x0000000000400000-0x000000000043D000-memory.exe
Size

244KB
MD5

f0cfb2a4d6dd11eda5219c594c9fddaa
SHA1

a66ab8b92d5951a53317f9859079908d682fba9c
SHA256

dded864374fbbe8528eb7dd1b6d02f108949680dc6778ddb186387b93df2bfd0
SHA512

288f9fd935e95ebb882917aafc615e6eb6a65fcaed86e29bbb2c9b63f8c82f64dec3fd7ab6dc96ed68db638496a95d2a03c0227e21d3982c4de19eb12cbaaf5c

Score

10^/10

arkei stealer

Malware Config

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3976 2388 WerFault.exe 1988-54-0x0000000000400000-0x000000000043D000-memory.exe

C:\Users\Admin\AppData\Local\Temp\1988-54-0x0000000000400000-0x000000000043D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1988-54-0x0000000000400000-0x000000000043D000-memory.exe"
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 192
2⤵
- Program crash
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2388 -ip 2388
1⤵
PID:4292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-130-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download