Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
02-10-2023 21:13
General
-
Target
1916-0-0x0000000000400000-0x000000000043D000-memory.exe
-
Size
244KB
-
MD5
4d9ccdb3d2fd18f83db2f069c5104ebc
-
SHA1
478d1dd338ffd0000535b6ce01b3c58e6d029a16
-
SHA256
e2fdd71763a6f97c6ef7ba312de69c4554b46a24174a43c82c98b6a86dd9e159
-
SHA512
c4de0e0e47938ce02dee6e2bac39e788e6f23164871cd034ba49002d21d4434ce801ac7ead9239eaa3a647b34e39e8647d0683735027d02fa3d716cba70dc23c
-
SSDEEP
1536:UYz/E8hW9NdYAygNlvhIoOl9SAKD7PNch1ZmmImh1ADN8blGe5SagvHLNaV8IJ3n:Um/E8k9ZjpIL+zNch12KbAwSaSgJSp8
Score
10/10
Malware Config
Signatures
-
Arkei
Arkei is an infostealer written in C++.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1916-0-0x0000000000400000-0x000000000043D000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1916-0-0x0000000000400000-0x000000000043D000-memory.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 2162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 180 -ip 1801⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB