ardamax | 1102c1266d44cc016a1c0faeb7c9ab2f0e1d0c586f4e79102ba8fa9562e3906d | Triage

Submit
Reports

Overview

overview

Static

static

1102c1266d...6d.exe

windows7-x64

1102c1266d...6d.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

1102c1266d44cc016a1c0faeb7c9ab2f0e1d0c586f4e79102ba8fa9562e3906d
Size

503KB
Sample

221003-khm68afdb9
MD5

040a6f862902b58f8834a30d6210e940
SHA1

280315638a68fb77cd061e79b335e656f565d682
SHA256

1102c1266d44cc016a1c0faeb7c9ab2f0e1d0c586f4e79102ba8fa9562e3906d
SHA512

f380cadbcf1b8c996480b2eb8416a4a5975eb24847927f922b158f54f9413f9435221a51f492d3f0abdddd71e87bd5e63350c30d690c3670cd37a805839c32fc
SSDEEP

12288:fdAJZ0gAwupD06xwovXDkByoTVV6JCfYiuV:q0gATDVOkXQnT3ICAiuV

Score

10^/10

ardamax discovery keylogger persistence stealer

Static task

static1

Behavioral task

behavioral1

Sample

1102c1266d44cc016a1c0faeb7c9ab2f0e1d0c586f4e79102ba8fa9562e3906d.exe

Resource

win7-20220901-en

ardamax discovery keylogger persistence stealer

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

1102c1266d44cc016a1c0faeb7c9ab2f0e1d0c586f4e79102ba8fa9562e3906d.exe

Resource

win10v2004-20220812-en

ardamax discovery keylogger persistence stealer

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  1102c1266d44cc016a1c0faeb7c9ab2f0e1d0c586f4e79102ba8fa9562e3906d
- Size
  
  503KB
- MD5
  
  040a6f862902b58f8834a30d6210e940
- SHA1
  
  280315638a68fb77cd061e79b335e656f565d682
- SHA256
  
  1102c1266d44cc016a1c0faeb7c9ab2f0e1d0c586f4e79102ba8fa9562e3906d
- SHA512
  
  f380cadbcf1b8c996480b2eb8416a4a5975eb24847927f922b158f54f9413f9435221a51f492d3f0abdddd71e87bd5e63350c30d690c3670cd37a805839c32fc
- SSDEEP
  
  12288:fdAJZ0gAwupD06xwovXDkByoTVV6JCfYiuV:q0gATDVOkXQnT3ICAiuV
Score

10^/10

ardamax discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerpersistencestealer

© 2018-2025

Terms | Privacy