arkei | f88ae9ab26aac70acdcfa84de42c1bda4856afd0b628076226765e3cdec076f8 | Triage

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 14:17

Sharing

Report Analysis Logs

General

Target

2000-54-0x0000000000400000-0x000000000043D000-memory.exe
Size

244KB
MD5

89ef86373b2e179ba1157a03ccb14150
SHA1

019eb36d6358f5986e7010451a9ed615502763f3
SHA256

f88ae9ab26aac70acdcfa84de42c1bda4856afd0b628076226765e3cdec076f8
SHA512

435e4b2dc639978113c9c054cd0c9302fce85102c5a0d150444f78e38f8edf7b6e560559981fe5e70b12bf57632f5f338acd99e4ff38d1c429a5ce8ab0d0351f

Score

10^/10

arkei stealer

Malware Config

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4236 4336 WerFault.exe 2000-54-0x0000000000400000-0x000000000043D000-memory.exe

C:\Users\Admin\AppData\Local\Temp\2000-54-0x0000000000400000-0x000000000043D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2000-54-0x0000000000400000-0x000000000043D000-memory.exe"
1⤵
PID:4336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 216
  2⤵
  - Program crash
  PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4336 -ip 4336
1⤵
PID:4380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4336-130-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download