ardamax | cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 20:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
Size

875KB
MD5

156067e5583afafc607ea837402fb88f
SHA1

0bea670e69354934028a424ff3824367e2369b31
SHA256

cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14
SHA512

1a35525f45112bd6910e56df852e640c5c8c4bd9be177cd54bc6329b25af8e34a882c671a49ce8d9dede49ce61782c12e24a0fcde9f29f82e72d7c5f0d5973c0
SSDEEP

12288:PJkXzV5eHqyxZNXdCTSmHE3TKIsZePdh0RaqZGTV26xGku+tj7ZueWUpfMa:hyDelZNITHm+I/3qZGTU4Gku+tfZ2+Ea

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000013a03-56.dat	family_ardamax
behavioral1/files/0x0007000000013a03-57.dat	family_ardamax
behavioral1/files/0x0007000000013a03-59.dat	family_ardamax
behavioral1/files/0x0007000000013a03-65.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
1708	GHFI.exe

Loads dropped DLL 5 IoCs

pid	Process
1896	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
1896	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
1896	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
1708	GHFI.exe
1708	GHFI.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	GHFI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GHFI Agent = "C:\\Windows\\SysWOW64\\28463\\GHFI.exe"	GHFI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\GHFI.001	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
File created	C:\Windows\SysWOW64\28463\GHFI.006	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
File created	C:\Windows\SysWOW64\28463\GHFI.007	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
File created	C:\Windows\SysWOW64\28463\GHFI.exe	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
File opened for modification	C:\Windows\SysWOW64\28463	GHFI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1708	GHFI.exe
Token: SeIncBasePriorityPrivilege	1708	GHFI.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1708	GHFI.exe
1708	GHFI.exe
1708	GHFI.exe
1708	GHFI.exe
1708	GHFI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1708	1896	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe	28
PID 1896 wrote to memory of 1708	1896	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe	28
PID 1896 wrote to memory of 1708	1896	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe	28
PID 1896 wrote to memory of 1708	1896	cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe	28

C:\Users\Admin\AppData\Local\Temp\cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe
"C:\Users\Admin\AppData\Local\Temp\cfe4a6f34c8d3a9fe0005d0816bf1624b2f465346a58afc16194e47c45a00e14.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\28463\GHFI.exe
  "C:\Windows\system32\28463\GHFI.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\AKV.exe

Filesize
393KB

MD5
1533823edeb16a2f6130b0eac0a74b1a

SHA1
c00306974e0acda509d547d8947abbd19e848827

SHA256
e330dedede24e626c90b2894697df4d81228d583203b80775de310dd315f6a9a

SHA512
2d72b0b822de528943348881aa2f0855ef4d306df52f343ebbd8d8b8845da4a79a01efd88c1abf7645e4a72c4069d6d5d4c4d85f1dcd580ac61a9e2657303a87

Download Submit
C:\Windows\SysWOW64\28463\GHFI.001

Filesize
486B

MD5
3533588d0433e957fdc31080fe814416

SHA1
19522ef0f7f93d1494d9f1919ae7568c0500ef3a

SHA256
0c766b7c5e708aebdca2e669c398dc6cf89de7e99d13ed39cb8f939824100438

SHA512
c4983cf92d437922992f8c2c843111db6d2df61f23c9893e1c0cba0540a82af7d900c51b39cfff2f932bc18b753dc3acf97b937d3289c8bc2e3df6e51d236cdb

Download Submit
C:\Windows\SysWOW64\28463\GHFI.006

Filesize
7KB

MD5
9bb764979044a263709a095f707fbf7f

SHA1
6a6ff5611d93c860401b165ff85957fbb340f14c

SHA256
6f55fcdfbdba9aef5252dfbb9a0f1ac9c83dac472659223ae5a7840484e2d95b

SHA512
a764c11ce03910f372ab7a19f251dbfcd369ad59a7e19b8f1a5825ef44f263d0c693f6bb69332bcb545ea397fc10497cbe4a83402a60971a07bdeb01ce19c057

Download Submit
C:\Windows\SysWOW64\28463\GHFI.007

Filesize
5KB

MD5
c14f089be45a2669a608c0cb4b5ed402

SHA1
6c3168f0af173afbc295848ad1bdb480c510097c

SHA256
dfd377848164271d02259d4481e7978a12392f71f7bcadaecae247d962127d08

SHA512
3c3bc020b74bd76eaa7b5fe577371fef420a62afa9512ef6a0d148b902fe98f8372358ab0f1213e389ad44d52a631ed117a6921be51d66734059cbfdef33ead9

Download Submit
C:\Windows\SysWOW64\28463\GHFI.exe

Filesize
472KB

MD5
a10c0ee1f0006cd3f58809ee8a6ab81f

SHA1
c4dcb5bffaaea97f7c6d850905a03c001a452d9a

SHA256
9ae3fe10cb437ef5f98a8731c63cd21a3a0791d231428bd264422acd4b57268f

SHA512
ece264bd37989f52bef0446f378b9c7f2d9f8b6af52cf9ba9234540b2a51b3b0faaa7f3e99ee854371a91650105660deeb0748a82d29733b5f69de15ba8a4157

Download Submit
C:\Windows\SysWOW64\28463\GHFI.exe

Filesize
472KB

MD5
a10c0ee1f0006cd3f58809ee8a6ab81f

SHA1
c4dcb5bffaaea97f7c6d850905a03c001a452d9a

SHA256
9ae3fe10cb437ef5f98a8731c63cd21a3a0791d231428bd264422acd4b57268f

SHA512
ece264bd37989f52bef0446f378b9c7f2d9f8b6af52cf9ba9234540b2a51b3b0faaa7f3e99ee854371a91650105660deeb0748a82d29733b5f69de15ba8a4157

Download Submit
\Users\Admin\AppData\Local\Temp\@25AB.tmp

Filesize
4KB

MD5
67ce8b2ea53b0aa6ec6213a2b62b9d95

SHA1
e4ac32be20e72d1c12d0ba6919d5fd209a85d009

SHA256
2daed63cd25eb939ae46c5a1caf7fe07bde609a859720884b51d324ff45fc4f6

SHA512
760bef7efb0750d860909f2c92ef2190d7a63b8d07d83ba17997a2cd5c92f509f6c645d86bfbf22c3baff8ebabbf14856f8f4998b9d7132db19785190071c29e

Download Submit
\Windows\SysWOW64\28463\GHFI.006

Filesize
7KB

MD5
9bb764979044a263709a095f707fbf7f

SHA1
6a6ff5611d93c860401b165ff85957fbb340f14c

SHA256
6f55fcdfbdba9aef5252dfbb9a0f1ac9c83dac472659223ae5a7840484e2d95b

SHA512
a764c11ce03910f372ab7a19f251dbfcd369ad59a7e19b8f1a5825ef44f263d0c693f6bb69332bcb545ea397fc10497cbe4a83402a60971a07bdeb01ce19c057

Download Submit
\Windows\SysWOW64\28463\GHFI.007

Filesize
5KB

MD5
c14f089be45a2669a608c0cb4b5ed402

SHA1
6c3168f0af173afbc295848ad1bdb480c510097c

SHA256
dfd377848164271d02259d4481e7978a12392f71f7bcadaecae247d962127d08

SHA512
3c3bc020b74bd76eaa7b5fe577371fef420a62afa9512ef6a0d148b902fe98f8372358ab0f1213e389ad44d52a631ed117a6921be51d66734059cbfdef33ead9

Download Submit
\Windows\SysWOW64\28463\GHFI.exe

Filesize
472KB

MD5
a10c0ee1f0006cd3f58809ee8a6ab81f

SHA1
c4dcb5bffaaea97f7c6d850905a03c001a452d9a

SHA256
9ae3fe10cb437ef5f98a8731c63cd21a3a0791d231428bd264422acd4b57268f

SHA512
ece264bd37989f52bef0446f378b9c7f2d9f8b6af52cf9ba9234540b2a51b3b0faaa7f3e99ee854371a91650105660deeb0748a82d29733b5f69de15ba8a4157

Download Submit
\Windows\SysWOW64\28463\GHFI.exe

Filesize
472KB

MD5
a10c0ee1f0006cd3f58809ee8a6ab81f

SHA1
c4dcb5bffaaea97f7c6d850905a03c001a452d9a

SHA256
9ae3fe10cb437ef5f98a8731c63cd21a3a0791d231428bd264422acd4b57268f

SHA512
ece264bd37989f52bef0446f378b9c7f2d9f8b6af52cf9ba9234540b2a51b3b0faaa7f3e99ee854371a91650105660deeb0748a82d29733b5f69de15ba8a4157

Download Submit
memory/1896-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download