arkei | 2ce76d4547bb19c7eefbcb1cf9669cc44abd7e565e44e48d10a4cddde8552715

General

Target

e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
Size

5.0MB
MD5

360a8874d4d0fe45bf44f54c82ae99d3
SHA1

f145f9c6e1ef7be5e0095d3cd7b6a337e32c25c6
SHA256

e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc
SHA512

7894365f80c2d78d85678eaeb1e2b876749e013b2ac297926ce452a6d304aa5ad408941cbc5b1cf9b31c4242b3eb0ebc39a0f6c94ea81655ac071fc77ad992e2
SSDEEP

98304:8Sir2GLhfKDyTuwdbvLMv4JROOLYG0WU7TKhhd1gonPcMc:LGRKDyTjDMvwOavbQWL1/ct

Score

10^/10

arkei babadeda default crypter discovery loader stealer

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

185.215.113.39/7vlcKuayFx.php

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Arkei family
arkei
Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c45-453.dat	family_babadeda

Babadeda family
babadeda

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp

Executes dropped EXE 3 IoCs

pid	Process
4588	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
1488	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
3160	evreporter.exe

Loads dropped DLL 1 IoCs

pid	Process
3160	evreporter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evreporter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1488	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
1488	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4588	3756	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	83
PID 3756 wrote to memory of 4588	3756	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	83
PID 3756 wrote to memory of 4588	3756	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	83
PID 4588 wrote to memory of 2548	4588	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	84
PID 4588 wrote to memory of 2548	4588	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	84
PID 4588 wrote to memory of 2548	4588	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	84
PID 2548 wrote to memory of 1488	2548	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	85
PID 2548 wrote to memory of 1488	2548	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	85
PID 2548 wrote to memory of 1488	2548	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe	85
PID 1488 wrote to memory of 3160	1488	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	86
PID 1488 wrote to memory of 3160	1488	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	86
PID 1488 wrote to memory of 3160	1488	e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp	86

C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
"C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Users\Admin\AppData\Local\Temp\is-90PR0.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-90PR0.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp" /SL5="$F0062,4382530,831488,C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe
    "C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\is-V4IC7.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-V4IC7.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp" /SL5="$90056,4382530,831488,C:\Users\Admin\AppData\Local\Temp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.exe" /VERYSILENT
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
        
        "C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-90PR0.tmp\e80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc.tmp

Filesize
3.0MB

MD5
19d3e925bd3944acf03a70e2da39e46f

SHA1
b7710e87fecbd6abf2d1e60cfdf4f524f184850a

SHA256
4d1fb84d2034c51f62e6e895e246d423f7b4fb2f1c2817a1aafc0a9c2cd68dc6

SHA512
241e6cdbbaf70101e707599cad2df08948a1bbc0ae554719e8cf58d713a89b6e06bbe1911baf0a0488a92f55520828c7a5f5ff6459bac499bff07ae13eee40f0

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe

Filesize
5.2MB

MD5
60c37f73b6d60884ad028ef1f026ddd7

SHA1
85409616ded051ccbe2a2854bc0c2be9a2166a14

SHA256
a7aa2196fdf652c469f5bbe4122f6bdddb6e3dd91a48e63181491f95fe102660

SHA512
cb4286729dc7e7fa901430ddd3f16e248372e94ad4a6e166ede1582e2486158c71b4c1bd4c8f4302622a308dda1caf46fbee5ec3c4f95fd7b4ea820a82f1a177

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\swresample-1.dll

Filesize
2.2MB

MD5
099e471203758f7653160a6f9f227d8d

SHA1
8246f4331f9aa47d2f9de96baafe2d1cf9bfa254

SHA256
eb9a87fc1b24a0e0476b34bfe4f22e0683f699bab9e7e50f42e3ae10c76c025b

SHA512
b7c7747277125ebc22ddc4f350212312ef6945a8f524b1f3088364c3c7b8618f480739c870037adc225c15db4887240b663c7e9d1657950171eba5ad76b3bbae

Download Submit
C:\Users\Admin\AppData\Roaming\Ev Reports Management\ui

Filesize
304KB

MD5
95518f5e98099572bede73302c79c7bd

SHA1
6168202123dca8fbc4a8e688561b5b18d51a462e

SHA256
115a380ecb81d1ddaa1c913c8ac6a1142400d22526ce979ed1a3d0a75ebf2e7a

SHA512
a0899e422b550498676b94aa9c9f59dfd5e0f6813e041f3e297698d5daa3501b186fc4a10e292f4ba445f7573d569f99a3916f4ee1f619df41492d4c2efee5e1

Download Submit
memory/1488-20-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/1488-455-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2548-11-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2548-9-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2548-457-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3160-451-0x0000000000400000-0x0000000000BBD000-memory.dmp

Filesize
7.7MB

Download
memory/3160-458-0x0000000000400000-0x0000000000BBD000-memory.dmp

Filesize
7.7MB

Download
memory/3756-15-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3756-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3756-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/4588-13-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/4588-6-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing