Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30/12/2023, 23:33
General
-
Target
Sro Pet Filter .exe
-
Size
1.1MB
-
MD5
812a0b8c11d100bdf10cf06d7b2e7842
-
SHA1
43404bb678a9b83112c019355a33833f1cc76abd
-
SHA256
c0a740688c19986853e92544d1b76e8e98f0c53da8e3aa37ccb89e559cae3bb4
-
SHA512
e7c068e46d23487f97b1dbfa597aebb9e01cb20dc800ea1cbeb4239800dc8d07efb91a8ea86b269fc28d4731b51d525d5f0ea6143aa20d8c22f22173aa28fd0c
-
SSDEEP
24576:CS/6JDU1ruPvqcGEAXK9PASGuEsavOX9y+1Nwc9sQQsmH/:CS841rAvKK+tuEs9tyUgsmH/
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 5 IoCs
-
Modifies AppInit DLL entries 2 TTPs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 10 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sro Pet Filter .exe"C:\Users\Admin\AppData\Local\Temp\Sro Pet Filter .exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Sys32\GLUW.exe"C:\Windows\system32\Sys32\GLUW.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\SRO Pet Filter.exe"C:\Users\Admin\AppData\Local\Temp\SRO Pet Filter.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD5991c8e08bd7756952869483db3ce173b
SHA18b41facdea222c2269d65f224382b849dca02cec
SHA25618928fc834d7e268885054b6801b1401ef1d959f73d01d2ca063eee2a73ae232
SHA512f76bd678632c6d60b1fa5b46b7e476c9eca58c9ae85e3fad71e4f8e62dbcac4af217d840e43eea08ea2d7d7c87cb7de16c9a89c7f62ed15e9a584aef38360574
-
Filesize
163KB
MD502725e54879401bcacf4ddd7a0f86c8c
SHA11772b424db3f3b97b8136f5277a4899e9618e78a
SHA2568af6f245a83dbfae075c67664b147ccef4b47f7a06e355bf223e93f92ef60815
SHA512ff5e80a607010a023a0979f7d7213fa02bbbf43711d23b79401b5466c58b24b2901c6fbeff8eef9a1ab26174f48596bdc60cad35e59eb8351dc92d75da2bac95
-
Filesize
374KB
MD53c5e120bbcf690b9589663e85f562227
SHA1d46fb68ff82ce127cf3e2fe70cc0f762e6bd60fa
SHA256f8a3eba772021d36a823651a4130b3666f21cb772117874d4736a21322e1ad26
SHA5126503920f438a82bd55d7a04422434f1861ff1aefb84b9c6f507f137a7573df578e1fa886de65474166f7e4cd31fc086bceea005d28caf5289796c18fd1215ed4
-
Filesize
378B
MD559cbd67b1b5822e7fc2310369c3da461
SHA171602325f6b32f3e4d5882b0b1c61598ab64dad7
SHA256da350c7ee04088166a1775276a9f7107b9fbf51206225fecb6610cbd5f5c61ad
SHA512f7f609c8a6508a646444911843094f44ca35fbfe8c75c8851ceb635fec9a22a9ebf2c7d7492941e14674107682fe2eee6cb0b6eb35e42084f9c136664a13cfd0
-
Filesize
5KB
MD53e1f5d5a06cf97b0495b8d129fbe02e4
SHA1b0de258a813f5edde85004f6865b6ed91f6d6f8f
SHA256f49448fc7c567e64eaeb9cc4dbd3c8021a82b5d9df0a622a439f7b42dc2f26d7
SHA512b0e0b81cb5776d298e96346aa61027c9799a47191c94de50be2209c32747774959d002ddeb98fd15556ee893b0d7bd1f0c8a901469dce4e3acf94e2c4c3e2bfd
-
Filesize
99KB
MD5f18c4f58b281e1bb09de93fce36325eb
SHA1d03693d631863fbc18a094da81b805c2559a5cb9
SHA256b4fea6b97d00690e8265ab8d624d9f9fc338bfd61b25905941dcb65467ae1da3
SHA5121913358d9976cdea190b95a0df37c309809eb7438da28b5f63b0576e3ea6734fea49884b8661fd3bf2feec53b1366ea87170cb5af5b868b47566c50d88e938fd
-
Filesize
112KB
MD5a7dc43fe0ae3f648866069d790b57948
SHA110460768cd36c90a53c8b8a0c4a94ede0321aaff
SHA2569e22b0634099161b0e8ff13daf607c7f4ea93c6f4e62358bf4509770f6fb6563
SHA512bac8e33cc43946fd6495b66a44905a69163993439a6f7c305162f0dab5c022f46056ecfad991f5643444846e3fe46cf82cf9f6936ed190e84bde25b7481172cc
-
Filesize
128KB
MD5ca939253a3ea97aa5d913ae381be8912
SHA1b5a70c83dc90d589ed3147a107e10b1878f716f5
SHA256a62981c1a4f9ceb6d31f0760649142bf65cfe9ee2c43983c52e4d8cb1b415df7
SHA512a58d2bb26f095a133ae6652c5d226bce16ecdae2f8cd7599542b520252002adebd90ef520706999e9b915272ef9a7dd5bc8339e633d16900b9ac096cb832a919
-
Filesize
4KB
MD533303ca8abef9221cb410b8a232e9fe4
SHA10cdfc25dbf0e9ad7d4585cd9037dc2e6604be00c
SHA2565110301dee966f0f26307ab1b430279d1e4999c2c4a0ea924ff32f1a9ded869a
SHA512da29821045773ba776def985966b62e09e69bb5bf1786b16c2fff6feb68a03b9e22c5f7d081e3dd58d1785cd7ac64736497c043b7cf6c7149c3a54f8ef111800
-
Filesize
218KB
MD52042d4096e64ca37b21ba0a96820ec2c
SHA12044b60afa142f1a650b70cea237970f4909e852
SHA256edae9bbc97b35d6af8855e742045a6e15adc404e0550248daa419d893d1b7803
SHA512d3334e782248f46e21fbbc639359d7081bb55476e004a10aefbc074de6978bf116454d0513cd99f53425950faa210b9e002741a8e40d6c5e0eac3631d4a1417b
-
Filesize
7KB
MD5928cc65dc793834c709a054ca57c19c8
SHA1a1e5d8407199c1bd6a4b274044de640fe0d9e99b
SHA256e3473d81a02ed30e4236591384136f41f17b6a4aae24b5468789644ccd4bf192
SHA512f7c8f7a75c4f8a418630e2ac15676740a902449d9a3c4baf3184409f8701c9caa3e82304d141362d95503f1af6b693eed7b77f690d92ca0162f7ea3ecbc80fdf
-
Filesize
423KB
MD59ff786016fa32692c3dc0a4e9f683b54
SHA19f23616936529daa660f7fab2befd769f484895e
SHA256fb261748471c12009c6eb99f68e23958aa9654317ec563bd9ae838adc9477c42
SHA512d704afc9b8e7f5917158833035735eb60e71f86ee3badf67d90e185278f6aa2e5be692a91b37bdb35d5436bca117cea31c772dee2bd2dae8dfbee49338a2e97c
-
Filesize
476KB
MD5ef52b540cb404d908338e9cbf7cff283
SHA1778765e1736c0a197685978c3fee7a44e7bde419
SHA25639d8bdb975fbfcbcec8fe63be4e9fe6ce39ae5d23a005118aeffa07b17a3f815
SHA512596b77bf5b15455c326a5a2efd66bc69685eb625e3e211ea0341ad4d8920ada7618a7107e42f2c0963fe6c2d92f2acf47b641ef33071a7c42004e5874d5219a6
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
5.7MB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
256KB