arkei | 2ce76d4547bb19c7eefbcb1cf9669cc44abd7e565e44e48d10a4cddde8552715

General

Target

e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
Size

5.0MB
MD5

360a8874d4d0fe45bf44f54c82ae99d3
SHA1

f145f9c6e1ef7be5e0095d3cd7b6a337e32c25c6
SHA256

e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc
SHA512

7894365f80c2d78d85678eaeb1e2b876749e013b2ac297926ce452a6d304aa5ad408941cbc5b1cf9b31c4242b3eb0ebc39a0f6c94ea81655ac071fc77ad992e2
SSDEEP

98304:8Sir2GLhfKDyTuwdbvLMv4JROOLYG0WU7TKhhd1gonPcMc:LGRKDyTjDMvwOavbQWL1/ct

Score

10^/10

arkei babadeda default crypter discovery loader stealer

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

185.215.113.39/7vlcKuayFx.php

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Arkei family
arkei
Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000001a4ab-452.dat	family_babadeda

Babadeda family
babadeda

Executes dropped EXE 3 IoCs

pid	Process
2536	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
2700	evreporter.exe

Loads dropped DLL 5 IoCs

pid	Process
3036	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
2976	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
2700	evreporter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evreporter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2536	3036	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	30
PID 3036 wrote to memory of 2536	3036	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	30
PID 3036 wrote to memory of 2536	3036	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	30
PID 3036 wrote to memory of 2536	3036	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	30
PID 3036 wrote to memory of 2536	3036	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	30
PID 3036 wrote to memory of 2536	3036	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	30
PID 3036 wrote to memory of 2536	3036	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	30
PID 2536 wrote to memory of 2976	2536	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	31
PID 2536 wrote to memory of 2976	2536	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	31
PID 2536 wrote to memory of 2976	2536	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	31
PID 2536 wrote to memory of 2976	2536	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	31
PID 2536 wrote to memory of 2976	2536	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	31
PID 2536 wrote to memory of 2976	2536	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	31
PID 2536 wrote to memory of 2976	2536	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	31
PID 2976 wrote to memory of 1316	2976	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	32
PID 2976 wrote to memory of 1316	2976	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	32
PID 2976 wrote to memory of 1316	2976	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	32
PID 2976 wrote to memory of 1316	2976	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	32
PID 2976 wrote to memory of 1316	2976	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	32
PID 2976 wrote to memory of 1316	2976	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	32
PID 2976 wrote to memory of 1316	2976	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	32
PID 1316 wrote to memory of 2700	1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	33
PID 1316 wrote to memory of 2700	1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	33
PID 1316 wrote to memory of 2700	1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	33
PID 1316 wrote to memory of 2700	1316	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	33

C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
"C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\is-FG7FT.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FG7FT.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp" /SL5="$400C6,4382530,831488,C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
    "C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe" /VERYSILENT
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\is-IKENR.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IKENR.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp" /SL5="$500C6,4382530,831488,C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
        
        "C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Ev Reports Management\ui

Filesize
304KB

MD5
95518f5e98099572bede73302c79c7bd

SHA1
6168202123dca8fbc4a8e688561b5b18d51a462e

SHA256
115a380ecb81d1ddaa1c913c8ac6a1142400d22526ce979ed1a3d0a75ebf2e7a

SHA512
a0899e422b550498676b94aa9c9f59dfd5e0f6813e041f3e297698d5daa3501b186fc4a10e292f4ba445f7573d569f99a3916f4ee1f619df41492d4c2efee5e1

Download Submit
\Users\Admin\AppData\Local\Temp\is-FG7FT.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp

Filesize
3.0MB

MD5
19d3e925bd3944acf03a70e2da39e46f

SHA1
b7710e87fecbd6abf2d1e60cfdf4f524f184850a

SHA256
4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

SHA512
241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

Download Submit
\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe

Filesize
5.2MB

MD5
60c37f73b6d60884ad028ef1f026ddd7

SHA1
85409616ded051ccbe2a2854bc0c2be9a2166a14

SHA256
a7aa2196fdf652c469f5bbe4122f6bdddb6e3dd91a48e63181491f95fe102660

SHA512
cb4286729dc7e7fa901430ddd3f16e248372e94ad4a6e166ede1582e2486158c71b4c1bd4c8f4302622a308dda1caf46fbee5ec3c4f95fd7b4ea820a82f1a177

Download Submit
\Users\Admin\AppData\Roaming\Ev Reports Management\swresample-1.dll

Filesize
2.2MB

MD5
099e471203758f7653160a6f9f227d8d

SHA1
8246f4331f9aa47d2f9de96baafe2d1cf9bfa254

SHA256
eb9a87fc1b24a0e0476b34bfe4f22e0683f699bab9e7e50f42e3ae10c76c025b

SHA512
b7c7747277125ebc22ddc4f350212312ef6945a8f524b1f3088364c3c7b8618f480739c870037adc225c15db4887240b663c7e9d1657950171eba5ad76b3bbae

Download Submit
memory/1316-443-0x00000000038A0000-0x00000000038B0000-memory.dmp

Filesize
64KB

Download
memory/1316-451-0x0000000004A10000-0x00000000051CD000-memory.dmp

Filesize
7.7MB

Download
memory/1316-455-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2536-14-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2536-9-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2700-453-0x0000000000400000-0x0000000000BBD000-memory.dmp

Filesize
7.7MB

Download
memory/2700-458-0x0000000000400000-0x0000000000BBD000-memory.dmp

Filesize
7.7MB

Download
memory/2976-12-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2976-457-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3036-16-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3036-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3036-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download

Analysis

Sharing