Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
18-11-2023 19:30
General
-
Target
1704-14-0x0000000000400000-0x000000000043D000-memory.exe
-
Size
244KB
-
MD5
f91104d14df581873fcf6f303e53feeb
-
SHA1
55f079e88518220c15c41e4dd88348ce24928285
-
SHA256
def6c030f46e8d7a9988942b704e41882da8584ef6456ec8358a9e8334f0a7f9
-
SHA512
448c5438136b85b4fcb39ace49a1eb94e8d46f3f355941ad4e002373c3c26d04ad0476e4cf47b747f2770934809407fc7fd6c02ce11afb6f483ea2fbc2701c91
-
SSDEEP
3072:Um/E8k9ZjpIL+zNch12KbAwSaSgJSp87b8EG:N/E8k91zz6/tR8EG
Malware Config
Signatures
-
Arkei
Arkei is an infostealer written in C++.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1704-14-0x0000000000400000-0x000000000043D000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1704-14-0x0000000000400000-0x000000000043D000-memory.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD533b2ba134395de308b182166b9f64b77
SHA1936beaf6ebca4389bbbee2aa061703cc0c086b03
SHA256f8693905daa402c88f88ec9c8c241aff783735166c511199fd91f3bda124cc80
SHA512c4f880b2616ff2541b53f021d180a7d0bd517deec196035850fba9275498f28db9f53dff920c5ec4a4ce6dcfb9d13a6e8a44d2ff497de0a30612f303be81fa5a
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
244KB