Overview

overview

10

Static

static

10

2176-0-0x0...ry.exe

windows7-x64

10

2176-0-0x0...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2023 04:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2176-0-0x0000000000400000-0x000000000043D000-memory.exe

  • Size

    244KB

  • MD5

    3ce70aebf1f7c085cf99af9bb536564c

  • SHA1

    925ed76cf570a65820b36542e71d544aa6ab81f7

  • SHA256

    527f7c850882c4c39bad07355e121801866be227ca6e48dc9d7cab7e37919c92

  • SHA512

    37ca4a351fe30c950929a30d58b6f7e2325b26b6c6304a5a79e84bac212aa3471c949f44b7946ddac47e427bc5fdb8ba705629a270e4e37e508a43c5eed292ae

  • SSDEEP

    1536:UYz/E8hW9NdYAygNlvhIoOl9SAKD7PNch1ZmmImh1ADN8blGe5SagvHLNaV8lJ3n:Um/E8k9ZjpIL+zNch12KbAwSaSNJSp8

Score
10/10
arkeistealer

Malware Config

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

    stealerarkei
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2176-0-0x0000000000400000-0x000000000043D000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2176-0-0x0000000000400000-0x000000000043D000-memory.exe"
    1⤵
      PID:4128
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 216
        2⤵
        • Program crash
        PID:3276
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4128 -ip 4128
      1⤵
        PID:3228

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4128-0-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download