ardamax | 2fd3c770bdee0f5366bea593f5215cfc10c2642278e91bd7a0eae247d32930a4

Analysis

max time kernel
157s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Osmanlı Bot.exe
Size 1.3MB
Sample231230-ac3plsdedl
SHA256 c45d51e25dc9bd378e997a242c0e0b8dc3f0bac67fe8d12cd5d18f7786e8ccc4
MD5 fe010d3bbb86067e66f3233bbbe6cbdb
SHA1 2b151b91a955d32a4d68b2a90586c741e09d28fc
SHA512 8bf65b5672da1c63dac4f2dd19e6001bc78536f920b529fc420cf4584665098d80c1da26b47ebd5c4e7e6010419d90d4c6a822df51d8783b98dfde76d870818b
SSDEEP 24576:CzwTT6O/SmlZ547pkSOG/hqemVh9ruez8cm8Lzw+0nXCaOQxMfN92Q6QAf:Cz+TRidOGJZm8Lc++0nSa7xG92Q6QA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 3 IoCs

resource	yara_rule
behavioral4/files/0x000600000002322b-8.dat	family_ardamax
behavioral4/files/0x000600000002322b-10.dat	family_ardamax
behavioral4/files/0x000600000002322b-11.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	Osmanlı Bot.exe

Executes dropped EXE 1 IoCs

pid	Process
1460	LKR.exe

Loads dropped DLL 1 IoCs

pid	Process
1460	LKR.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LKR Start = "C:\\Windows\\SysWOW64\\RHMWRT\\LKR.exe"	LKR.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RHMWRT\	LKR.exe
File created	C:\Windows\SysWOW64\RHMWRT\LKR.004	Osmanlı Bot.exe
File created	C:\Windows\SysWOW64\RHMWRT\LKR.001	Osmanlı Bot.exe
File created	C:\Windows\SysWOW64\RHMWRT\LKR.002	Osmanlı Bot.exe
File created	C:\Windows\SysWOW64\RHMWRT\AKV.exe	Osmanlı Bot.exe
File created	C:\Windows\SysWOW64\RHMWRT\LKR.exe	Osmanlı Bot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1460	LKR.exe
1460	LKR.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1460	LKR.exe
Token: SeIncBasePriorityPrivilege	1460	LKR.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1460	LKR.exe
1460	LKR.exe
1460	LKR.exe
1460	LKR.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1460	4412	Osmanlı Bot.exe	93
PID 4412 wrote to memory of 1460	4412	Osmanlı Bot.exe	93
PID 4412 wrote to memory of 1460	4412	Osmanlı Bot.exe	93

C:\Users\Admin\AppData\Local\Temp\Osmanlı Bot.exe
"C:\Users\Admin\AppData\Local\Temp\Osmanlı Bot.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\RHMWRT\LKR.exe
  "C:\Windows\system32\RHMWRT\LKR.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\RHMWRT\AKV.exe
Size 149KB
SHA256 df27f4dfdd7d6c004033d68846db072bdb9eb0781d732112170f99107573a6fe
MD5 b642837631a9f3947aaece7b3e8c7d31
SHA1 c9d3854ab32915086fc151e9b0b941412cd9b439
SHA512 4ae29df80919aaf9b67fba15653c7d205bcbbe327b04303c547d0cefddcc3e88a3ac3da04583a9d88d8efb0b0566301eebca7ccac52b6a0dc64302c62e7c920f
SSDEEP 3072:6nNumaFxdF9GCnxifQWg64pfphw3LKikqNcx:dWc62phwLKiTNcx
MD5 SHA1 SHA512 SSDEEP

Submit Download

LKR.001

Path C:\Windows\SysWOW64\RHMWRT\LKR.001
Size 61KB
SHA256 baecddca15ea6932b9cd4e7f5bae848c3c290660a85c408b898150c6f8fd744e
MD5 9681d3e1f2c53ad98b8467b3acca33fc
SHA1 04d5d08781f27d6e08ad0262f7325b2be4db7743
SHA512 5c6191fb676ace9d1c2ddfd4e98651959ab24b718ab626c343e2bb271d31edd8ba43ed9de528c7832ddcc2137d2424c22bb19f115dc252e1400cfcd3edce2098
SSDEEP 768:i8l4X5RHID8lQyOciUfXycURsQ2LEaBy/m05BvPaoH4AHFiwK385M3nA:u/oidiBPSQ24aM9PaoY/45M3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

LKR.002

Path C:\Windows\SysWOW64\RHMWRT\LKR.002
Size 44KB
SHA256 e8a9477bc04824357c0f0bcc1cb665e1dfb6cf5c05f68517749f6cb11821cec2
MD5 e65e4bdb2c86226589b88f101153c01b
SHA1 731be43621721dba20f0bb74966ea08043ef37fd
SHA512 7700ee197f109a8f2cff2e529715e371e36c1d9924af0bedef9285f76898d3448847af3bff342813b9bd8ca619b7c39b9607150596008ffc6fe68b338f6769cd
SSDEEP 768:zu7VuBauW7qOEyPdc0rjgt1KiaVfIVltQpAm/y/01jWTMRg:8GauW+O1TrEjOfIVltQb3pRg
MD5 SHA1 SHA512 SSDEEP

Submit Download

LKR.004

Path C:\Windows\SysWOW64\RHMWRT\LKR.004
Size 1KB
SHA256 e3c8a4cd204f39f357b17dfb6f1423651ab6a10df0effcc7ebf17f5c2570c173
MD5 f07947c86e8f045f73382d8b38ac9607
SHA1 85808ca38c0fea7af8959c7fcf5240d40165ce3b
SHA512 7a5c102dea9d3f19efc43766d948d9f87482ec35f091f49fbd891ca7a4b8db1802c01b8c3be100f4ead571f38481ebc884e1bc3b43766a97d643a5bc87e5deaa
MD5 SHA1 SHA512

Submit Download

LKR.exe

Path C:\Windows\SysWOW64\RHMWRT\LKR.exe
Size 64KB
SHA256 124efa3b0b32efd9e8d8faa6f28b470fe71b1fdb68cfe6995a0b0c824082b435
MD5 013a8a5a2ce65d6a7bd98d90bc34b6c2
SHA1 056c1a946087fafb951d3b551ba56b64fe7d4465
SHA512 439c25f3930153ca6b9f059306525205f759a034636d6c8e04b7b0286c9afbe71456ed10ac631bc496a815a0c21400124549ce685079c31d6b33f295291b9870
SSDEEP 768:0e5UT+tKnNaQJv23mZ1MMWJTcsKlVEJJRWRVXqGPpGJazoN+hTMa7i2u2NtXSPIi:0e51KL+ksuVxcbySMZ3k+5mUMrGo5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

LKR.exe

Path C:\Windows\SysWOW64\RHMWRT\LKR.exe
Size 136KB
SHA256 5a6b198e4f2741f737cc3bb5344745003b07e314a4695d5e7a7b0a5f0cac6fde
MD5 11267055b7d6d17d0d3a832b517766ea
SHA1 1409c4ba9d22ad86ffc5e90595f4676e6a8575fa
SHA512 15fcc3994c6bf69d5bb3439d3cda0f6c21afc0cd5687c37040fd7688665b421146844bf166e9cadcfa4787bc1570521c6ca7c5b9a54e6b5a3af0acf3ce7ab8a8
SSDEEP 1536:0e51KL+ksuVxcbySMZ3k+5mUMrGo59h/0EovclcUBgeHJo/DWfa0ot:0e514xzSMZ3nmh959eEdXOuk
MD5 SHA1 SHA512 SSDEEP

Submit Download

LKR.exe

Path C:\Windows\SysWOW64\RHMWRT\LKR.exe
Size 145KB
SHA256 d46112589e88c29182e48410e2377dd586dae213820c4be05d8022a7bc64e035
MD5 4faff9b4755926edfaa49f242d70f46d
SHA1 056b6a680a8bc2b7aa3274b915c46e116f920bb7
SHA512 7f943d1f342a1dc1e2b8e397c29678176a3b887cad32a1b0867b9c6ee85aac2d6a8a8046a03c83776a7f8ca99118a7cfc145901163fbcdb8385d1e42f10e52e1
SSDEEP 1536:0e51KL+ksuVxcbySMZ3k+5mUMrGo59h/0EovclcUBgeHJo/DWfa0o+2xDHkQf4:0e514xzSMZ3nmh959eEdXOuN2xLj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1460-16-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/1460-18-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download