arkei | 56848946dec883b076cc7fa364f2b55c5ee1e5991f3cccc5522f099d44c6c061

Analysis

max time kernel
136s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 05:48

Target

8b8da82499438c53f17cafe74e5e672f.exe
Size

324KB
MD5

8b8da82499438c53f17cafe74e5e672f
SHA1

b6db6c98f6636808a2b720db3da2533722efff6f
SHA256

56848946dec883b076cc7fa364f2b55c5ee1e5991f3cccc5522f099d44c6c061
SHA512

26723a8a34ece3613ab41a09dd46759724b9b16bd5c74d79f45e33f4bbefae5b45a66050c214a722d1684aaa5ec6252aaa366fd112aacb633006fd1513d56dbf
SSDEEP

6144:u9NXvkyRZWnb9kb75DiMKCroE7bVG9WfJy7ur9eO6n:mvk6ZWnudDiMKCEE/VNMOU

Score

10^/10

arkei stealer

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2320 880 WerFault.exe 8b8da82499438c53f17cafe74e5e672f.exe

pid	pid_target	process	target process
2320	880	WerFault.exe	8b8da82499438c53f17cafe74e5e672f.exe

C:\Users\Admin\AppData\Local\Temp\8b8da82499438c53f17cafe74e5e672f.exe
"C:\Users\Admin\AppData\Local\Temp\8b8da82499438c53f17cafe74e5e672f.exe"
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 552
2⤵
- Program crash
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 880 -ip 880
1⤵
PID:4372

memory/880-1-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/880-2-0x00000000032D0000-0x00000000032E9000-memory.dmp

Filesize
100KB

Download
memory/880-3-0x0000000000400000-0x000000000324C000-memory.dmp

Filesize
46.3MB

Download
memory/880-4-0x0000000000400000-0x000000000324C000-memory.dmp

Filesize
46.3MB

Download
memory/880-5-0x0000000000400000-0x000000000324C000-memory.dmp

Filesize
46.3MB

Download
memory/880-6-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/880-7-0x00000000032D0000-0x00000000032E9000-memory.dmp

Filesize
100KB

Download
memory/880-8-0x0000000000400000-0x000000000324C000-memory.dmp

Filesize
46.3MB

Download