Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1728-0-0x0...ry.exe

windows7-x64

10

1728-0-0x0...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    176s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 10:24 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1728-0-0x0000000000400000-0x000000000043D000-memory.exe

  • Size

    244KB

  • MD5

    a3d1bf801e5404b75ee4af6449da28ee

  • SHA1

    fcd02ecf0f6d0925c8b8207365213fd84f171528

  • SHA256

    bbed3509bccd9b5313e5b97cc68944528c12c87eac69525b379c9a38204aed72

  • SHA512

    061b1563647bd07c59fb45622c2bfc14b6aabade8bdbc10ab614adf213ad73f3efb507f923ebddef4fae034242fa7510d3a12f4860a9f2692cb1b93fb238e0cd

  • SSDEEP

    1536:UYz/E8hW9NdYAygNlvhIoOl9SAKD7PNch1ZmmImh1ADN8blGe5SagvHLNaV86J3n:Um/E8k9ZjpIL+zNch12KbAwSaSyJSp8

Score
10/10
arkeistealer

Malware Config

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1728-0-0x0000000000400000-0x000000000043D000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1728-0-0x0000000000400000-0x000000000043D000-memory.exe"
    1⤵
      PID:5040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 216
        2⤵
        • Program crash
        PID:3064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5040 -ip 5040
      1⤵
        PID:4576

      Network

      • flag-us
        DNS
        59.128.231.4.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.231.4.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        240.81.21.72.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.81.21.72.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        183.59.114.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        183.59.114.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        126.20.238.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        126.20.238.8.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        71.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        71.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        2.136.104.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.136.104.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        158.240.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        158.240.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        4.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        4.173.189.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        9.57.101.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        9.57.101.20.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        59.128.231.4.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        59.128.231.4.in-addr.arpa

      • 8.8.8.8:53
        240.81.21.72.in-addr.arpa
        dns
        71 B
         142 B
         1
        1

        DNS Request

        240.81.21.72.in-addr.arpa

      • 8.8.8.8:53
        183.59.114.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        183.59.114.20.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        126.20.238.8.in-addr.arpa
        dns
        71 B
         125 B
         1
        1

        DNS Request

        126.20.238.8.in-addr.arpa

      • 8.8.8.8:53
        71.159.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        71.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        2.136.104.51.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        2.136.104.51.in-addr.arpa

      • 8.8.8.8:53
        158.240.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        158.240.127.40.in-addr.arpa

      • 8.8.8.8:53
        4.173.189.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        4.173.189.20.in-addr.arpa

      • 8.8.8.8:53
        9.57.101.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        9.57.101.20.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/5040-0-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.