ardamax | 1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48

Analysis

max time kernel
328s
max time network
344s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe
Size

2.1MB
MD5

326e062ef4cd0703fd25cad2b790a9de
SHA1

80a485276b8e9226b707ca6a91b22d9e57d6b3ab
SHA256

1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48
SHA512

797b33b0f129dfda1b279d71fe8f12cc5d7b7d972500d68a7c3a844d8200202b1f27ca1b1b07da2a6cb4c5d438bf19b5478ae16cd9d8ba1eef409596d9c5de3e
SSDEEP

49152:jULTQS5es7C6ealJs497FYVJwyeJR2Gww9N5qp+p:jU4sneQP9xYVMJR2GVHG

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000022dde-133.dat	family_ardamax
behavioral2/files/0x0006000000022dde-134.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
1072	QKS.exe
4828	HLBOT.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe

Loads dropped DLL 2 IoCs

pid	Process
1072	QKS.exe
4828	HLBOT.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	QKS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QKS Start = "C:\\Windows\\JHCABD\\QKS.exe"	QKS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\JHCABD\QKS.002	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe
File created	C:\Windows\JHCABD\AKV.exe	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe
File created	C:\Windows\JHCABD\QKS.chm	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe
File created	C:\Windows\JHCABD\QKS.003	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe
File created	C:\Windows\JHCABD\QKS.exe	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe
File opened for modification	C:\Windows\JHCABD\	QKS.exe
File created	C:\Windows\JHCABD\QKS.004	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe
File created	C:\Windows\JHCABD\QKS.001	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1072	QKS.exe
Token: SeIncBasePriorityPrivilege	1072	QKS.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1072	QKS.exe
1072	QKS.exe
1072	QKS.exe
1072	QKS.exe
4828	HLBOT.exe
4828	HLBOT.exe
4828	HLBOT.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1072	3872	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe	83
PID 3872 wrote to memory of 1072	3872	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe	83
PID 3872 wrote to memory of 1072	3872	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe	83
PID 3872 wrote to memory of 4828	3872	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe	85
PID 3872 wrote to memory of 4828	3872	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe	85
PID 3872 wrote to memory of 4828	3872	1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe	85

C:\Users\Admin\AppData\Local\Temp\1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe
"C:\Users\Admin\AppData\Local\Temp\1eb3e76acad7f7ac258b0a4a3b82ce8b881a8e494496378217fbb2901ad2dc48.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\JHCABD\QKS.exe
  "C:\Windows\JHCABD\QKS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\HLBOT.exe
  "C:\Users\Admin\AppData\Local\Temp\HLBOT.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HLBOT.exe

Filesize
24KB

MD5
903ed7119329d78d4ad63597b774e445

SHA1
70d4b2ef3eca8e72b54f7e2215acec6e34cc0d33

SHA256
6a90da5081a8bd52d827efbc19608803ce0609bab94c44abc10c2a816a6f30aa

SHA512
7b5a3fb19f5ef21cdae077b8e5751731ea9422da3a657a7213c5620c620137f963160cb64c1480bdec0581eec4e09ecaab1a7fa6e2d52604b8c1bf3e99d97dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HLBOT.exe

Filesize
24KB

MD5
903ed7119329d78d4ad63597b774e445

SHA1
70d4b2ef3eca8e72b54f7e2215acec6e34cc0d33

SHA256
6a90da5081a8bd52d827efbc19608803ce0609bab94c44abc10c2a816a6f30aa

SHA512
7b5a3fb19f5ef21cdae077b8e5751731ea9422da3a657a7213c5620c620137f963160cb64c1480bdec0581eec4e09ecaab1a7fa6e2d52604b8c1bf3e99d97dbe

Download Submit
C:\Windows\JHCABD\AKV.exe

Filesize
456KB

MD5
48cfaed4d566c34716326302b49bdad2

SHA1
566e0989b6bc7ed205f9ae250ea98e3a4d7fba52

SHA256
54c2e10de3ed7135d20c239a7f656c6ff57d1158607fa4c6779e042681de87ea

SHA512
96c871ed9af039142aab5904021d3ef3f75a58c5cc1fdf4d59e40e3699fd03e7cff384b788f7359a1de519ebdcafdad55891fef4f67e2c216ea89ebc945996a0

Download Submit
C:\Windows\JHCABD\QKS.001

Filesize
60KB

MD5
a15c556f17d7db8287e023138942d5db

SHA1
880bf8ec944120830dc2e2e040e5996e4e0e6c83

SHA256
f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e

SHA512
930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd

Download Submit
C:\Windows\JHCABD\QKS.001

Filesize
60KB

MD5
a15c556f17d7db8287e023138942d5db

SHA1
880bf8ec944120830dc2e2e040e5996e4e0e6c83

SHA256
f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e

SHA512
930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd

Download Submit
C:\Windows\JHCABD\QKS.001

Filesize
60KB

MD5
a15c556f17d7db8287e023138942d5db

SHA1
880bf8ec944120830dc2e2e040e5996e4e0e6c83

SHA256
f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e

SHA512
930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd

Download Submit
C:\Windows\JHCABD\QKS.002

Filesize
43KB

MD5
daabecdfba287a3333b60ae82211acd7

SHA1
e67b4c7bf0dd71ad47263a58bb60be4bce504b84

SHA256
12981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173

SHA512
937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f

Download Submit
C:\Windows\JHCABD\QKS.003

Filesize
65KB

MD5
50148e8898154d41dca9bbb93d89b26e

SHA1
0821bb26168c7fc10dbd2dc689bc9fa4d7921a9f

SHA256
3914b3af63db284678a342c124410143ba35926f72ea47c71af7776b50f1f9a2

SHA512
97365b487e9961b06eb7a3d0e26963dc4d1236a3174af6d8287dd2d31db34ece59ec0dd4fb193d2e320cc53a4f83676a64f0069cfbdce19ea9aa3ea2478fe583

Download Submit
C:\Windows\JHCABD\QKS.004

Filesize
1KB

MD5
0d4b8279afd1f1c334b016fee02727a4

SHA1
72bcdffeb2c2a0be08b2802d4995527303cf8b7f

SHA256
d93c3bd0350c79f6436261513ff88596fe6ef40a212277cb088e701589e4de51

SHA512
becc6b6dfb09d239ece1e26f8d4aedcdd79310517ae78535a48d2e654dbc62aa4a4c26be9fbd8e7856f1ed8b2055ea95bd1a03214c41b6aa40d3e76b59f9d32e

Download Submit
C:\Windows\JHCABD\QKS.chm

Filesize
913KB

MD5
686d5d5b14228aed4f28c64905dbc7d3

SHA1
b20c10d76ba0a211f08ea2cdbc91d6df8eb73342

SHA256
963aceba76888e94a6eef9316b83d2396634556abedfd33fdae5392d2c218446

SHA512
eb23e753a8ac7ca37382cb3cccc2957132ac5e6ef02b209360dd4f7c7cdd12495a25066526905d0c8bb0923383a57ab6c79ccd28aca5c05270821d5ace975bae

Download Submit
C:\Windows\JHCABD\QKS.exe

Filesize
1.7MB

MD5
f3819a6cab8ae058254c4abb3844d87e

SHA1
0f8b1a74af87f1823ec0d76e21a8d54d55a53a8b

SHA256
3d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9

SHA512
dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57

Download Submit
C:\Windows\JHCABD\QKS.exe

Filesize
1.7MB

MD5
f3819a6cab8ae058254c4abb3844d87e

SHA1
0f8b1a74af87f1823ec0d76e21a8d54d55a53a8b

SHA256
3d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9

SHA512
dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57

Download Submit
memory/4828-145-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4828-148-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download