ardamax | cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14 | Triage

Submit
Reports

Overview

overview

Static

static

cfe4a6f34c...14.exe

windows7-x64

cfe4a6f34c...14.exe

windows10-2004-x64

Sharing

General

Target

cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14
Size

875KB
Sample

220919-yx6h1abcap
MD5

156067e5583afafc607ea837402fb88f
SHA1

0bea670e69354934028a424ff3824367e2369b31
SHA256

cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14
SHA512

1a35525f45112bd6910e56df852e640c5c8c4bd9be177cd54bc6329b25af8e34a882c671a49ce8d9dede49ce61782c12e24a0fcde9f29f82e72d7c5f0d5973c0
SSDEEP

12288:PJkXzV5eHqyxZNXdCTSmHE3TKIsZePdh0RaqZGTV26xGku+tj7ZueWUpfMa:hyDelZNITHm+I/3qZGTU4Gku+tfZ2+Ea

Score

10^/10

ardamax discovery keylogger persistence stealer

Static task

static1

Behavioral task

behavioral1

Sample

cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe

Resource

win7-20220812-en

ardamax discovery keylogger persistence stealer

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe

Resource

win10v2004-20220812-en

ardamax discovery keylogger persistence stealer

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14
- Size
  
  875KB
- MD5
  
  156067e5583afafc607ea837402fb88f
- SHA1
  
  0bea670e69354934028a424ff3824367e2369b31
- SHA256
  
  cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14
- SHA512
  
  1a35525f45112bd6910e56df852e640c5c8c4bd9be177cd54bc6329b25af8e34a882c671a49ce8d9dede49ce61782c12e24a0fcde9f29f82e72d7c5f0d5973c0
- SSDEEP
  
  12288:PJkXzV5eHqyxZNXdCTSmHE3TKIsZePdh0RaqZGTV26xGku+tj7ZueWUpfMa:hyDelZNITHm+I/3qZGTU4Gku+tfZ2+Ea
Score

10^/10

ardamax discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerpersistencestealer

© 2018-2024

Terms | Privacy