analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635

Full analysis: https://app.any.run/tasks/b09641a8-a08e-40eb-ad1a-a1b4e60aefa1
Verdict: Malicious activity
Threats:

Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 00:05:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arkei
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

B4A5E3D80219A9E039B322A30929E0E8

SHA1:

49A86043BF2FB36C37EF1F8345FB1203788CFC4C

SHA256:

B2753D2782D31F9B99932638271C4306EA84B61D38DA3FE6468F5487B8508635

SSDEEP:

6144:wI4MeTYb8F4tbelpx8IpllwGxTQEAtYZ3S8E/woq/8YSBXxjdZmaxzM+0SR3YAQD:ig6SKlpx8I94YZ3CqExx0+0FpUUkrAP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1160)

    • Uses Task Scheduler to run other applications

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1160)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3112)

    • Application was injected by another process

      • Explorer.EXE (PID: 912)

    • Runs injected code in another process

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1868)

    • ARKEI detected by memory dumps

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1868)

  • SUSPICIOUS

    • Checks supported languages

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1160)
      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1868)

    • Executable content was dropped or overwritten

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1160)

    • Creates files in the user directory

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1160)

    • Reads the computer name

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1160)
      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1868)

    • Drops a file with a compile date too recent

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1160)

    • Application launched itself

      • b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe (PID: 1160)

  • INFO

    • Checks supported languages

      • schtasks.exe (PID: 3112)

    • Reads the computer name

      • schtasks.exe (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (72.2)
.scr | Windows screen saver (12.9)
.dll | Win32 Dynamic Link Library (generic) (6.4)
.exe | Win32 Executable (generic) (4.4)
.exe | Generic Win/DOS Executable (1.9)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Aug-01 02:27:35
Comments: -
CompanyName: Builders Emporium
FileDescription: Kruskal
FileVersion: 1.0.0.1
InternalName: ExceptionHandlingClauseOpti.exe
LegalCopyright: Builders Emporium 2022 (C)
LegalTrademarks: -
OriginalFilename: ExceptionHandlingClauseOpti.exe
ProductName: Kruskal
ProductVersion: 1.0.0.1
Assembly Version: 1.0.0.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2022-Aug-01 02:27:35
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
599784
600064
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.36273
.rsrc
614400
7696
8192
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.14246
.reloc
622592
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
7.87768
5964
UNKNOWN
UNKNOWN
RT_ICON
32512
1.51664
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON
1 (#2)
3.34074
912
UNKNOWN
UNKNOWN
RT_VERSION
1 (#3)
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start inject b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe schtasks.exe no specs #ARKEI b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1160"C:\Users\admin\AppData\Local\Temp\b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe" C:\Users\admin\AppData\Local\Temp\b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe
Explorer.EXE
User:
admin
Company:
Builders Emporium
Integrity Level:
MEDIUM
Description:
Kruskal
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
3112"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dTxeIQQKn" /XML "C:\Users\admin\AppData\Local\Temp\tmp7309.tmp"C:\Windows\System32\schtasks.exe—b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1868"C:\Users\admin\AppData\Local\Temp\b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe"C:\Users\admin\AppData\Local\Temp\b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe
b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe
User:
admin
Company:
Builders Emporium
Integrity Level:
MEDIUM
Description:
Kruskal
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
912C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
604
Read events
574
Write events
30
Delete events
0

Modification events

(PID) Process:(912) Explorer.EXEKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(912) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02
(PID) Process:(912) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
FFFFFFFF
(PID) Process:(912) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:Mode
Value:
1
(PID) Process:(912) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:LogicalViewMode
Value:
3
(PID) Process:(912) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:FFlags
Value:
(PID) Process:(912) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconSize
Value:
48
(PID) Process:(912) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:ColInfo
Value:
00000000000000000000000000000000FDDFDFFD100000000000000000000000040000001800000030F125B7EF471A10A5F102608C9EEBAC0A000000A000000030F125B7EF471A10A5F102608C9EEBAC0C00000050000000A66A63283D95D211B5D600C04FD918D00B0000007800000030F125B7EF471A10A5F102608C9EEBAC0E00000078000000
(PID) Process:(912) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:Sort
Value:
000000000000000000000000000000000100000030F125B7EF471A10A5F102608C9EEBAC0A00000001000000
(PID) Process:(912) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:GroupView
Value:
0
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1160b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exeC:\Users\admin\AppData\Roaming\dTxeIQQKn.exeexecutable
MD5:B4A5E3D80219A9E039B322A30929E0E8
SHA256:B2753D2782D31F9B99932638271C4306EA84B61D38DA3FE6468F5487B8508635
1160b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exeC:\Users\admin\AppData\Local\Temp\tmp7309.tmpxml
MD5:FF2DF0DF151CACA338F80ED79AAA02FA
SHA256:B9CECBD03C3CB1901D262166CF549E84E254E392D0F0AD2B72995EBBB26DB005
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1868
b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635.exe
76.8.53.138:1198
—
D102-PHL-1
US
malicious

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b2753d2782d31f9b99932638271c4306ea84b61d38da3fe6468f5487b8508635