Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1544-54-0x...ry.exe

windows7-x64

10

1544-54-0x...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2022, 14:38 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1544-54-0x0000000000400000-0x000000000043D000-memory.exe

  • Size

    244KB

  • MD5

    4450a49f75de39992fc30c2bc4d6b0c8

  • SHA1

    2c517dc3c33dcbe90236020f9a7548fdb9cebbb1

  • SHA256

    79337837359d157164c95be9132d2bd0ff45df4c31e7fdd6016a3220312dec19

  • SHA512

    136f543aa331b3d26bee138ab7772b402fb4956e0473d6257bb1ebaf2ae7a7e04679e73b0e534f03b6dff981984f76ce6a27f2bbcd9f2927aac18f8e4f01bbae

  • SSDEEP

    1536:UYz/E8hW9NdYAygNlvhIoOl9SAKD7PNch1ZmmImh1ADN8blGe5SagvHLNaV8eJ3n:Um/E8k9ZjpIL+zNch12KbAwSaSWJSp8

Score
10/10
arkeistealer

Malware Config

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1544-54-0x0000000000400000-0x000000000043D000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1544-54-0x0000000000400000-0x000000000043D000-memory.exe"
    1⤵
      PID:2156
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 216
        2⤵
        • Program crash
        PID:1120
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2156 -ip 2156
      1⤵
        PID:4172

      Network

      • flag-unknown
        DNS
        176.122.125.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        176.122.125.40.in-addr.arpa
        IN PTR
        Response
      • 209.197.3.8:80
        322 B
         7
      • 104.80.225.205:443
        322 B
         7
      • 52.168.112.66:443
        322 B
         7
      • 209.197.3.8:80
        322 B
         7
      • 209.197.3.8:80
        322 B
         7
      • 209.197.3.8:80
        322 B
         7
      • 8.8.8.8:53
        176.122.125.40.in-addr.arpa
        dns
        73 B
         159 B
         1
        1

        DNS Request

        176.122.125.40.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2156-132-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.