Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
10-10-2023 16:36
General
-
Target
1972-0-0x0000000000400000-0x000000000043D000-memory.exe
-
Size
244KB
-
MD5
5c294c3121589317a843097c1b94ee6c
-
SHA1
0eef51b7d1a8009f3fa8c3d1fbc911a2a4ff1980
-
SHA256
c00c7ff10c1b2b829b6b108fb65c1339e1a0d2dc0413e208b70ac483b5303a2d
-
SHA512
067af52e13b19fd97d4d1b5ae86e375617d9845c0f85796a26533013dad6524af2cb1091af0f7955147ac9985d4ec2ede0bd1e10061a6d8eb571fda7b03a8bdb
-
SSDEEP
1536:UYz/E8hW9NdYAygNlvhIoOl9SAKD7PNch1ZmmImh1ADN8blGe5SagvHLNaV87J3n:Um/E8k9ZjpIL+zNch12KbAwSaSTJSp8
Score
10/10
Malware Config
Signatures
-
Arkei
Arkei is an infostealer written in C++.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1972-0-0x0000000000400000-0x000000000043D000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1972-0-0x0000000000400000-0x000000000043D000-memory.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 1842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2420 -ip 24201⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
244KB