Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
08-10-2023 14:15
General
-
Target
1492-64-0x0000000000400000-0x000000000043D000-memory.exe
-
Size
244KB
-
MD5
45c2cef2d6df48cc86ff2c61ea3584a2
-
SHA1
090e12e6b6b7cf7f849f5b593814fb8e67407d73
-
SHA256
49ca9d0568e5f235d7e4d695cfc0a58515e95489cd3132de5b27822dce6778d3
-
SHA512
d5badee61cfd74e6b8d7922a5c4274ab1f2e4b559b47012d78c7b7748028b09096b5ff1cf430d06c7ae78447ea00fe7967669d8df269fd9480288095f89bf524
-
SSDEEP
3072:Um/E8k9ZjpIn+zNch12KbAwSaSYJSp8H/b8EG:N/E8k91rz6/tx8EG
Score
10/10
Malware Config
Signatures
-
Arkei
Arkei is an infostealer written in C++.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1492-64-0x0000000000400000-0x000000000043D000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1492-64-0x0000000000400000-0x000000000043D000-memory.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
244KB