arkei | 49ca9d0568e5f235d7e4d695cfc0a58515e95489cd3132de5b27822dce6778d3

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2023 14:15

Target

1492-64-0x0000000000400000-0x000000000043D000-memory.exe
Size

244KB
MD5

45c2cef2d6df48cc86ff2c61ea3584a2
SHA1

090e12e6b6b7cf7f849f5b593814fb8e67407d73
SHA256

49ca9d0568e5f235d7e4d695cfc0a58515e95489cd3132de5b27822dce6778d3
SHA512

d5badee61cfd74e6b8d7922a5c4274ab1f2e4b559b47012d78c7b7748028b09096b5ff1cf430d06c7ae78447ea00fe7967669d8df269fd9480288095f89bf524
SSDEEP

3072:Um/E8k9ZjpIn+zNch12KbAwSaSYJSp8H/b8EG:N/E8k91rz6/tx8EG

Score

10^/10

arkei stealer

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 728 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	728	svchost.exe

C:\Users\Admin\AppData\Local\Temp\1492-64-0x0000000000400000-0x000000000043D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1492-64-0x0000000000400000-0x000000000043D000-memory.exe"
1⤵
PID:3376

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:728

memory/728-1-0x000002A743340000-0x000002A743350000-memory.dmp

Filesize
64KB

Download
memory/728-17-0x000002A743440000-0x000002A743450000-memory.dmp

Filesize
64KB

Download
memory/728-33-0x000002A74B760000-0x000002A74B761000-memory.dmp

Filesize
4KB

Download
memory/728-35-0x000002A74B790000-0x000002A74B791000-memory.dmp

Filesize
4KB

Download
memory/728-36-0x000002A74B790000-0x000002A74B791000-memory.dmp

Filesize
4KB

Download
memory/728-37-0x000002A74B8A0000-0x000002A74B8A1000-memory.dmp

Filesize
4KB

Download
memory/3376-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download