ardamax | 2fd3c770bdee0f5366bea593f5215cfc10c2642278e91bd7a0eae247d32930a4

General

Target
Osmanlı Bot.exe
Size 1.3MB
Sample231230-ac3plsdedl
SHA256 c45d51e25dc9bd378e997a242c0e0b8dc3f0bac67fe8d12cd5d18f7786e8ccc4
MD5 fe010d3bbb86067e66f3233bbbe6cbdb
SHA1 2b151b91a955d32a4d68b2a90586c741e09d28fc
SHA512 8bf65b5672da1c63dac4f2dd19e6001bc78536f920b529fc420cf4584665098d80c1da26b47ebd5c4e7e6010419d90d4c6a822df51d8783b98dfde76d870818b
SSDEEP 24576:CzwTT6O/SmlZ547pkSOG/hqemVh9ruez8cm8Lzw+0nXCaOQxMfN92Q6QAf:Cz+TRidOGJZm8Lc++0nSa7xG92Q6QA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 2 IoCs

resource	yara_rule
behavioral3/files/0x0006000000015d58-6.dat	family_ardamax
behavioral3/files/0x0006000000015d58-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2740	LKR.exe

Loads dropped DLL 2 IoCs

pid	Process
3028	Osmanlı Bot.exe
2740	LKR.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LKR Start = "C:\\Windows\\SysWOW64\\RHMWRT\\LKR.exe"	LKR.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RHMWRT\AKV.exe	Osmanlı Bot.exe
File created	C:\Windows\SysWOW64\RHMWRT\LKR.exe	Osmanlı Bot.exe
File opened for modification	C:\Windows\SysWOW64\RHMWRT\	LKR.exe
File created	C:\Windows\SysWOW64\RHMWRT\LKR.004	Osmanlı Bot.exe
File created	C:\Windows\SysWOW64\RHMWRT\LKR.001	Osmanlı Bot.exe
File created	C:\Windows\SysWOW64\RHMWRT\LKR.002	Osmanlı Bot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2740	LKR.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2740	LKR.exe
Token: SeIncBasePriorityPrivilege	2740	LKR.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2740	LKR.exe
2740	LKR.exe
2740	LKR.exe
2740	LKR.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2740	3028	Osmanlı Bot.exe	28
PID 3028 wrote to memory of 2740	3028	Osmanlı Bot.exe	28
PID 3028 wrote to memory of 2740	3028	Osmanlı Bot.exe	28
PID 3028 wrote to memory of 2740	3028	Osmanlı Bot.exe	28

C:\Users\Admin\AppData\Local\Temp\Osmanlı Bot.exe
"C:\Users\Admin\AppData\Local\Temp\Osmanlı Bot.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\RHMWRT\LKR.exe
  "C:\Windows\system32\RHMWRT\LKR.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\RHMWRT\AKV.exe
Size 92KB
SHA256 cf8a45da7431f2b0e921c0dde698f56e4afcbac5bc28c1f84b6f7e705d4f5954
MD5 d9d415f4c6fd4e47907191b798d123a8
SHA1 109c61461c9366b23439ca6b7dc759bb12a70e58
SHA512 e17bcfc3e51864cc0e15e9891b0e7ede524b84cdc69ef82cef495d3e0559f99a9984e663fea00c37716e21733684e31bbfe89a81073bb5ed58051271c8fb6952
SSDEEP 1536:6SyNumaFBhCntCd7TF7pGEeSgQqYytoZAEIQWOHwtfWNwCw8aR9l:6nNumaFxdF9GCnxifQWg64pfq
MD5 SHA1 SHA512 SSDEEP

Submit Download

LKR.exe

Path C:\Windows\SysWOW64\RHMWRT\LKR.exe
Size 833KB
SHA256 a2b11f4468fb45000bada7164842eead645311b99560397a67a0ffa661acd3d1
MD5 20ffb649b7af2e58c1747b12c41aaf3c
SHA1 7daf1e96213e4c1813712f390e1e6c1410dbdcbc
SHA512 3718f41aa5a0b8ed98b007e2a6598e6095cce312e4925caaa4a2a8b9c10f8bf3c4054a2759eac22b679333eb9ca0e9ee5f360ae4d29a2620888becc5f1cf5f01
SSDEEP 24576:+0soL/weaP5C+FuKGxGoo5VwRePDh6+vPCbbI1fB4:xweaP5C+4wPmePQufe
MD5 SHA1 SHA512 SSDEEP

Submit Download

LKR.exe

Path \Windows\SysWOW64\RHMWRT\LKR.exe
Size 630KB
SHA256 cf76be3f48d1794c48058fa09d804cb79f8cbddbf272e2e10701e94073540a69
MD5 43c39255eaebe73a72ecfc7cdb7c5650
SHA1 45fc9af81fd91596820ce33b6bb3837944fa2080
SHA512 aac21e71966c91e8a24a7d6d576c75699be206433e72419585d898e2e0d5f231f52e1f8272a4e7a614d64e5ef780faa426b49068bde8e645d22be9a82fc34ced
SSDEEP 12288:+y5sB5Pdr6LDrw5B5sNiUafXNzAF+FuKGxEHoo5VwR3OaKDR:+0soL/weaP5C+FuKGxGoo5VwRePDR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2740-15-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/2740-17-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads