Analysis
-
max time kernel
19s -
max time network
19s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28-06-2024 17:39
General
-
Target
MarsStealer6_cracked_by_LLCPPC.exe
-
Size
107KB
-
MD5
41c1fb2f4bd3c65cb0030b1f47a46084
-
SHA1
199420219f0096cfb156945a54933a03144da70d
-
SHA256
f335705b83540e68ddd17c68232c2f5ca67b0479cdc3ad8ff11931db6c134764
-
SHA512
93d4778a35b766b17824c62817421ac224027d6b699afde1281aaaedff7443d3d2c29d1ded98dc1dc318a67d51c2ad3f3b6df83b1c247da9e534f27ae7b0abfe
-
SSDEEP
1536:+YMNChaEb9Y3R1OK8jqfu/b4A48GFBoagvHxMaBYRSyOHm9RNKQFGo:bMNCha6O8jhb4AKDoaSkRS8RMr
Score
10/10
Malware Config
Extracted
Family
arkei
Botnet
Default
Signatures
-
Arkei
Arkei is an infostealer written in C++.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 24 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MarsStealer6_cracked_by_LLCPPC.exe"C:\Users\Admin\AppData\Local\Temp\MarsStealer6_cracked_by_LLCPPC.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 2522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2368 -ip 23681⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB