Overview

overview

10

Static

static

4427053e2d...69.exe

windows7-x64

10

4427053e2d...69.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4427053e2df1e1c9cb7ef7b3131c097d2676d279805c9e620053d19efe1c6469

  • Size

    785KB

  • Sample

    221002-lafmvaacfj

  • MD5

    67904ceebc2d60baafb73f3c119e9be1

  • SHA1

    b85396b8a67fb469fa001a1070bbb0ba90f9607e

  • SHA256

    4427053e2df1e1c9cb7ef7b3131c097d2676d279805c9e620053d19efe1c6469

  • SHA512

    b0c58bd6e94b444714b64b667a7342800c06d188c20f627acbc33ef5531baec0e3c6b3cf5a3c102b0f2be1fdb5661a7418407f7a4d18f746d04bf830c463cafe

  • SSDEEP

    12288:JEXQ9t3S0sq3tz4ekl996E4iISTf9i4eQoEpTHbUERQziIvBo+dC6F8APV0lJqjC:kCt3XER99lf6QoEp7bKznBvM6v+lY2

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      4427053e2df1e1c9cb7ef7b3131c097d2676d279805c9e620053d19efe1c6469

    • Size

      785KB

    • MD5

      67904ceebc2d60baafb73f3c119e9be1

    • SHA1

      b85396b8a67fb469fa001a1070bbb0ba90f9607e

    • SHA256

      4427053e2df1e1c9cb7ef7b3131c097d2676d279805c9e620053d19efe1c6469

    • SHA512

      b0c58bd6e94b444714b64b667a7342800c06d188c20f627acbc33ef5531baec0e3c6b3cf5a3c102b0f2be1fdb5661a7418407f7a4d18f746d04bf830c463cafe

    • SSDEEP

      12288:JEXQ9t3S0sq3tz4ekl996E4iISTf9i4eQoEpTHbUERQziIvBo+dC6F8APV0lJqjC:kCt3XER99lf6QoEp7bKznBvM6v+lY2

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks