Overview

overview

10

Static

static

e625645691...4d.exe

windows7-x64

10

e625645691...4d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e62564569111adfa9c5a0a8a00c8acba4d1c5e723e2a6908776956fa12ee154d

  • Size

    1.1MB

  • Sample

    221002-ladhgsacer

  • MD5

    71b197eca25e94ea5458c514b3613a1c

  • SHA1

    02758b299c226664faa6325ae3471e2bb9b2f22b

  • SHA256

    e62564569111adfa9c5a0a8a00c8acba4d1c5e723e2a6908776956fa12ee154d

  • SHA512

    43521ddcbe5983bd86f45cf1f22e7911949b095aa7f48478bdbd60fafd7c52f358546a7fbfa1214e0fab7c8f3c5b9e12097f4f7a78e91272143f7c9eeac46316

  • SSDEEP

    24576:ERtToD991L9GUPZ46hPBvaz0Pk4HJjNugZ+doKr5CYvcNlgph0c:nTGA95yK3H2k25JvcNli

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      e62564569111adfa9c5a0a8a00c8acba4d1c5e723e2a6908776956fa12ee154d

    • Size

      1.1MB

    • MD5

      71b197eca25e94ea5458c514b3613a1c

    • SHA1

      02758b299c226664faa6325ae3471e2bb9b2f22b

    • SHA256

      e62564569111adfa9c5a0a8a00c8acba4d1c5e723e2a6908776956fa12ee154d

    • SHA512

      43521ddcbe5983bd86f45cf1f22e7911949b095aa7f48478bdbd60fafd7c52f358546a7fbfa1214e0fab7c8f3c5b9e12097f4f7a78e91272143f7c9eeac46316

    • SSDEEP

      24576:ERtToD991L9GUPZ46hPBvaz0Pk4HJjNugZ+doKr5CYvcNlgph0c:nTGA95yK3H2k25JvcNli

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks