arkei | f88ae9ab26aac70acdcfa84de42c1bda4856afd0b628076226765e3cdec076f8 | Triage

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 14:16

Sharing

Report Analysis Logs

General

Target

1704-54-0x0000000000400000-0x000000000043D000-memory.exe
Size

244KB
MD5

89ef86373b2e179ba1157a03ccb14150
SHA1

019eb36d6358f5986e7010451a9ed615502763f3
SHA256

f88ae9ab26aac70acdcfa84de42c1bda4856afd0b628076226765e3cdec076f8
SHA512

435e4b2dc639978113c9c054cd0c9302fce85102c5a0d150444f78e38f8edf7b6e560559981fe5e70b12bf57632f5f338acd99e4ff38d1c429a5ce8ab0d0351f

Score

10^/10

arkei stealer

Malware Config

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4836 4976 WerFault.exe 1704-54-0x0000000000400000-0x000000000043D000-memory.exe

C:\Users\Admin\AppData\Local\Temp\1704-54-0x0000000000400000-0x000000000043D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1704-54-0x0000000000400000-0x000000000043D000-memory.exe"
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 216
2⤵
- Program crash
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4976 -ip 4976
1⤵
PID:3484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4976-130-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download