ardamax | 98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9

General

Target

98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe
Size

525KB
MD5

c4af9473a3792d6c759223ae88cd111e
SHA1

d74f2bd9db7bb7b0d7afe64fe473bcbef73d3481
SHA256

98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9
SHA512

00ff6baeffd478596264bbc6ac7de7ba03604cb5bace461522f230c96da9962f98895c0ac9047aae30b90ff48b4c6d7b696795a8b38663a6f6ff245fe158fbec
SSDEEP

12288:4LlgtecvR7k9TQGWENrAv/EAm3bYI+ElcEwRsFa4T8WIYQHI:ClgtpvlS7E438pWcJ54T/n

Score

10^/10

ardamax keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000122ec-57.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
1396	system32WBSN.exe
1244	Tibiabot ng crack 1.1.exe

Loads dropped DLL 4 IoCs

pid	Process
1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe
1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe
1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe
1244	Tibiabot ng crack 1.1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	system32WBSN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system32WBSN Agent = "C:\\Windows\\system32WBSN.exe"	system32WBSN.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\BASSMOD.dll	Tibiabot ng crack 1.1.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32AKV.exe	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe
File created	C:\Windows\system32WBSN.001	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe
File created	C:\Windows\system32WBSN.006	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe
File created	C:\Windows\system32WBSN.007	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe
File created	C:\Windows\system32WBSN.exe	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1104	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1104	AUDIODG.EXE
Token: 33	1104	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1104	AUDIODG.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1396	1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe	28
PID 1788 wrote to memory of 1396	1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe	28
PID 1788 wrote to memory of 1396	1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe	28
PID 1788 wrote to memory of 1396	1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe	28
PID 1788 wrote to memory of 1244	1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe	29
PID 1788 wrote to memory of 1244	1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe	29
PID 1788 wrote to memory of 1244	1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe	29
PID 1788 wrote to memory of 1244	1788	98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe	29

C:\Users\Admin\AppData\Local\Temp\98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe
"C:\Users\Admin\AppData\Local\Temp\98c1dc5bdf34fe6d0ef589481306650049e2afa75b1cfb62ebd549b61806cfc9.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32WBSN.exe
  "C:\Windows\system32WBSN.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1396
- C:\Users\Admin\AppData\Local\Temp\Tibiabot ng crack 1.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Tibiabot ng crack 1.1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:1244

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x578
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tibiabot ng crack 1.1.exe

Filesize
70KB

MD5
30577d7b70ba0a4d6df68278f6007e72

SHA1
af1d6c92a66c63f3102e28fc97dea87087472485

SHA256
34cf81cd9e22f1b4f6f1ec0f64110e82a822d9892e17b13db8137e9f31267c7e

SHA512
5ee7e590015eaf40058b0c6558ae9bfa7ffa4848dc4144b5cfb91ff5cbaef52957eda16167a6812d902daf426e7872479d425dcb349af7ecfd2ffecc7685a230

Download Submit
C:\Windows\system32WBSN.001

Filesize
450B

MD5
62f6b66fcf234b839451401e72424f91

SHA1
dae0c88db7797aed3a96e45ad3ace8654de774ac

SHA256
5587715ddf902b094473f9a3af10f6b75d5378b94a24a91396e3d4bd9ad6c073

SHA512
1f8a8ea3ec37058b60a2011f7f1a611da2e799716ad6226063ea70638b5b2b00c56222a1fbb3c548e3200015433da479762a8bee83d11f105aeff46291bfbf4a

Download Submit
C:\Windows\system32WBSN.exe

Filesize
471KB

MD5
3c06bbc025b61d2182ef5573f2852bda

SHA1
ebc1464c00b13fb5b3f80a59c80b595020e1fe7c

SHA256
e7f64e7215284cdeb8ef1eba28733f7aeae7f6977f82809d8de1e76a2e249085

SHA512
9d839ada211b85fc1efb1fe7bb3ce66fcf0e8069221d958234649c2ac5dc0f1bd06f1a016f9c727077af36fb46cac5409be9c8a8201d17f689c6b473aa01acdc

Download Submit
\Users\Admin\AppData\Local\Temp\@EB4A.tmp

Filesize
4KB

MD5
d9e02f226fc338d14df200ba9a700625

SHA1
414f134a16a309b31e418ed9e08c0c48aaf6e2bc

SHA256
8165757efb79acceb9fd0bfae6b2c19b8f087cc0461abb17941d460dbdf2e260

SHA512
13c73381602fe2593312d41ab4bc5cd5f922ac651f9e71e3fe3c58e7f0c5c73ecc9d79d61ec46f33a0a81cf73373421eeb510bd99650c0f53af30974ed61b8ca

Download Submit
\Users\Admin\AppData\Local\Temp\Tibiabot ng crack 1.1.exe

Filesize
70KB

MD5
30577d7b70ba0a4d6df68278f6007e72

SHA1
af1d6c92a66c63f3102e28fc97dea87087472485

SHA256
34cf81cd9e22f1b4f6f1ec0f64110e82a822d9892e17b13db8137e9f31267c7e

SHA512
5ee7e590015eaf40058b0c6558ae9bfa7ffa4848dc4144b5cfb91ff5cbaef52957eda16167a6812d902daf426e7872479d425dcb349af7ecfd2ffecc7685a230

Download Submit
\Users\Admin\AppData\Local\Temp\Tibiabot ng crack 1.1.exe

Filesize
70KB

MD5
30577d7b70ba0a4d6df68278f6007e72

SHA1
af1d6c92a66c63f3102e28fc97dea87087472485

SHA256
34cf81cd9e22f1b4f6f1ec0f64110e82a822d9892e17b13db8137e9f31267c7e

SHA512
5ee7e590015eaf40058b0c6558ae9bfa7ffa4848dc4144b5cfb91ff5cbaef52957eda16167a6812d902daf426e7872479d425dcb349af7ecfd2ffecc7685a230

Download Submit
\Windows\SysWOW64\BASSMOD.dll

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
memory/1244-62-0x0000000000000000-mapping.dmp

Download
memory/1244-66-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1244-67-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1244-68-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1396-56-0x0000000000000000-mapping.dmp

Download
memory/1788-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing