ardamax | 001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3

General

Target

001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe
Size

2.2MB
MD5

b4ad074a8cc0932332dd435c4ec3052e
SHA1

1654e08d948b9a78d54bb143f49acc1dd088835d
SHA256

001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3
SHA512

80adc6c39e1f227f4e3ec02333f4ecdbaa06391757e0b27fa3927fea772a13bfb1192b132766cd9f860389c5c41f500b60b94c2c437e32689cdf3b45761472a4
SSDEEP

49152:WuWek/PEyYF3YyKbYuWP1Cv+9iw7ejivqrt5PmZSoaXUHQ16:QXqe8xP1ri865PIaXZ16

Score

10^/10

ardamax keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Executes dropped EXE 1 IoCs

Processes:

KUB.exe

pid process

3556 KUB.exe

pid	process
3556	KUB.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe

Loads dropped DLL 2 IoCs

Processes:

KUB.exe

pid process

3556 KUB.exe
3556 KUB.exe

pid	process
3556	KUB.exe
3556	KUB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

KUB.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KUB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KUB Start = "C:\\ProgramData\\LGGKBU\\KUB.exe"	KUB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

KUB.exe

pid process

3556 KUB.exe
3556 KUB.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

KUB.exe

pid process

3556 KUB.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

KUB.exe

pid process

3556 KUB.exe
3556 KUB.exe
3556 KUB.exe
3556 KUB.exe
3556 KUB.exe

pid	process
3556	KUB.exe
3556	KUB.exe

pid	process
3556	KUB.exe

pid	process
3556	KUB.exe
3556	KUB.exe
3556	KUB.exe
3556	KUB.exe
3556	KUB.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe

description	pid	process	target process
PID 1488 wrote to memory of 3556	1488	001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe	KUB.exe
PID 1488 wrote to memory of 3556	1488	001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe	KUB.exe
PID 1488 wrote to memory of 3556	1488	001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe	KUB.exe

C:\Users\Admin\AppData\Local\Temp\001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe
"C:\Users\Admin\AppData\Local\Temp\001288a0433a4f7f7773e6a6eb6239a2833a248c1c22a51536d2e999826d32b3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1488

C:\ProgramData\LGGKBU\KUB.exe
"C:\ProgramData\LGGKBU\KUB.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\LGGKBU\KUB.00
Filesize
2KB

MD5
f9e49f33a333b1b61d52538a8e49b99e

SHA1
bd40dda68204a726e8e4d8ca8375157059a118e9

SHA256
966722aff64ad9a3c4ef1bf36a2fc1133b9c8266b4e6304feaf0eb914b385514

SHA512
f762c437f727cae3d67d3cefd0b39ea922b56367b4a43565cb3f1ccf043974291b5a984f8ba13708ba6fa3042d6586606fc92b39657b4f86ea3b4be763ca2232

Download Submit
C:\ProgramData\LGGKBU\KUB.01
Filesize
80KB

MD5
73ecd165caf523ac9fc02542a0a93783

SHA1
d267cc30b7c7eda31b5b8c2e64073e443c2668a9

SHA256
93b7d535f84e308025ba7aeeae27032dcbc015119c59142ecad25b1f28fe47c9

SHA512
711abb91062540c70d31e177d9e16b68022b3ed0042668233b54d76f780cc1cb10ae04f9c5ad6be2828ef4e002b09c6328d9af76709274835887f7d83c68338d

Download Submit
C:\ProgramData\LGGKBU\KUB.01
Filesize
80KB

MD5
73ecd165caf523ac9fc02542a0a93783

SHA1
d267cc30b7c7eda31b5b8c2e64073e443c2668a9

SHA256
93b7d535f84e308025ba7aeeae27032dcbc015119c59142ecad25b1f28fe47c9

SHA512
711abb91062540c70d31e177d9e16b68022b3ed0042668233b54d76f780cc1cb10ae04f9c5ad6be2828ef4e002b09c6328d9af76709274835887f7d83c68338d

Download Submit
C:\ProgramData\LGGKBU\KUB.01
Filesize
80KB

MD5
73ecd165caf523ac9fc02542a0a93783

SHA1
d267cc30b7c7eda31b5b8c2e64073e443c2668a9

SHA256
93b7d535f84e308025ba7aeeae27032dcbc015119c59142ecad25b1f28fe47c9

SHA512
711abb91062540c70d31e177d9e16b68022b3ed0042668233b54d76f780cc1cb10ae04f9c5ad6be2828ef4e002b09c6328d9af76709274835887f7d83c68338d

Download Submit
C:\ProgramData\LGGKBU\KUB.exe
Filesize
2.4MB

MD5
50397dee100535a5c76759ba33871b0d

SHA1
21eebd3baf3642f8cc9e57b46e3321e25b63e3e5

SHA256
ef567d0021c74b99011379cbc02d132d87fb771009b6821b981e06cf62f2761a

SHA512
a64f9031fef566f71b39294cc9cbfeb14b528e5cb67bbaec684a6bd34a7e03515e3fd5351f0a36c27d70938c1b7c89d5d3c91ddafa1d4d6eab447e5ec941dff8

Download Submit
C:\ProgramData\LGGKBU\KUB.exe
Filesize
2.4MB

MD5
50397dee100535a5c76759ba33871b0d

SHA1
21eebd3baf3642f8cc9e57b46e3321e25b63e3e5

SHA256
ef567d0021c74b99011379cbc02d132d87fb771009b6821b981e06cf62f2761a

SHA512
a64f9031fef566f71b39294cc9cbfeb14b528e5cb67bbaec684a6bd34a7e03515e3fd5351f0a36c27d70938c1b7c89d5d3c91ddafa1d4d6eab447e5ec941dff8

Download Submit
memory/1488-132-0x0000000000F40000-0x0000000001179000-memory.dmp

Filesize
2.2MB

Download
memory/1488-136-0x0000000000F40000-0x0000000001179000-memory.dmp

Filesize
2.2MB

Download
memory/3556-133-0x0000000000000000-mapping.dmp

Download
memory/3556-141-0x0000000002650000-0x0000000002669000-memory.dmp

Filesize
100KB

Download
memory/3556-142-0x0000000002651000-0x0000000002660000-memory.dmp

Filesize
60KB

Download
memory/3556-143-0x0000000002650000-0x0000000002669000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads