ardamax | f85d94f00d20a450d004a0c63b98126bf17ef25a68525f2653938900bb6d1a36

Analysis

max time kernel
151s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
599b6716a911972afa37d0e34ccea3b6.exe
Size 1.1MB
Sample240113-2p2rmagdf3
SHA256 f85d94f00d20a450d004a0c63b98126bf17ef25a68525f2653938900bb6d1a36
MD5 599b6716a911972afa37d0e34ccea3b6
SHA1 2f753ac06d8ad978cee6fae298a1d1f5854e0c9f
SHA512 a812bd84cbb58baff3c0b813a06b815afe014e50d1c24d808a903199c526732029556b6afbe8556b075dd6b91513d20dd88d82c17aa95ce7e119f4e9c19554d8
SSDEEP 24576:4CQpHD5JH6m0hl9lUtwnzzSKih3y/F77DnDAlcta0aYG:MpHHanetMih3y/F77v0c80aYG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000500000001e7e4-37.dat	family_ardamax

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	599b6716a911972afa37d0e34ccea3b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	599b6716a911972afa37d0e34ccea3b6.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	fuckyou.exe

Executes dropped EXE 2 IoCs

pid	Process
8	fuckyou.exe
4692	TGHD.exe

Loads dropped DLL 4 IoCs

pid	Process
8	fuckyou.exe
4692	TGHD.exe
4692	TGHD.exe
4692	TGHD.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TGHD Agent = "C:\\Windows\\SysWOW64\\28463\\TGHD.exe"	TGHD.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\TGHD.exe	fuckyou.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	fuckyou.exe
File opened for modification	C:\Windows\SysWOW64\28463	TGHD.exe
File created	C:\Windows\SysWOW64\28463\TGHD.001	fuckyou.exe
File created	C:\Windows\SysWOW64\28463\TGHD.006	fuckyou.exe
File created	C:\Windows\SysWOW64\28463\TGHD.007	fuckyou.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\1.bat	599b6716a911972afa37d0e34ccea3b6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Implemented Categories	599b6716a911972afa37d0e34ccea3b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Implemented Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}	599b6716a911972afa37d0e34ccea3b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mscoree.dll"	599b6716a911972afa37d0e34ccea3b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\Class = "System.ObsoleteAttribute"	599b6716a911972afa37d0e34ccea3b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\RuntimeVersion = "v1.1.4322"	599b6716a911972afa37d0e34ccea3b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ThreadingModel = "Both"	599b6716a911972afa37d0e34ccea3b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgId	599b6716a911972afa37d0e34ccea3b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}	599b6716a911972afa37d0e34ccea3b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ = "System.ObsoleteAttribute"	599b6716a911972afa37d0e34ccea3b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32	599b6716a911972afa37d0e34ccea3b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\Assembly = "mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	599b6716a911972afa37d0e34ccea3b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgId\ = "System.ObsoleteAttribute"	599b6716a911972afa37d0e34ccea3b6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2652	599b6716a911972afa37d0e34ccea3b6.exe
Token: SeIncBasePriorityPrivilege	2652	599b6716a911972afa37d0e34ccea3b6.exe
Token: 33	4692	TGHD.exe
Token: SeIncBasePriorityPrivilege	4692	TGHD.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	599b6716a911972afa37d0e34ccea3b6.exe
4692	TGHD.exe
4692	TGHD.exe
4692	TGHD.exe
4692	TGHD.exe
4692	TGHD.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 8	2652	599b6716a911972afa37d0e34ccea3b6.exe	92
PID 2652 wrote to memory of 8	2652	599b6716a911972afa37d0e34ccea3b6.exe	92
PID 2652 wrote to memory of 8	2652	599b6716a911972afa37d0e34ccea3b6.exe	92
PID 2652 wrote to memory of 3292	2652	599b6716a911972afa37d0e34ccea3b6.exe	93
PID 2652 wrote to memory of 3292	2652	599b6716a911972afa37d0e34ccea3b6.exe	93
PID 2652 wrote to memory of 3292	2652	599b6716a911972afa37d0e34ccea3b6.exe	93
PID 2652 wrote to memory of 3828	2652	599b6716a911972afa37d0e34ccea3b6.exe	94
PID 2652 wrote to memory of 3828	2652	599b6716a911972afa37d0e34ccea3b6.exe	94
PID 2652 wrote to memory of 3828	2652	599b6716a911972afa37d0e34ccea3b6.exe	94
PID 8 wrote to memory of 4692	8	fuckyou.exe	99
PID 8 wrote to memory of 4692	8	fuckyou.exe	99
PID 8 wrote to memory of 4692	8	fuckyou.exe	99

C:\Users\Admin\AppData\Local\Temp\599b6716a911972afa37d0e34ccea3b6.exe
"C:\Users\Admin\AppData\Local\Temp\599b6716a911972afa37d0e34ccea3b6.exe"
1⤵
- Checks BIOS information in registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\fuckyou.exe
  C:\fuckyou.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\28463\TGHD.exe
    "C:\Windows\system32\28463\TGHD.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\raptor.bat
  2⤵
  PID:3292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\1.bat
  2⤵
  PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@BD2.tmp

Path C:\Users\Admin\AppData\Local\Temp\@BD2.tmp
Size 4KB
SHA256 fd9c203a32eec0afe4ab1e3ae02c68ac27649120bb3f0af68852ba487384ecaf
MD5 ac2120f3b2fb824a5c1f3752dc944d21
SHA1 8bfbf3887103e886736e0802f88ed860a450856e
SHA512 474d77a27e3553aa58b394e77317a770f700f59580820741269e6c4746e664ce483a33a51baecd45ef4ac1a13e451a2c47d95c9abb79c7bc5cf902646f78c90f
SSDEEP 48:6mhIS9tRcE2bHmIhiwNK0e+mvt55kVIPKx5M9p1GO0HIr:6+/tRmCsibWi54rU1GTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.bat

Path C:\Windows\1.bat
Size 159B
SHA256 f3b54ac8502e56ef44bfc3b7ff46fedfb4de6ee2ec0d13b536eea3462f788c21
MD5 17b5bbb3c4bd2ec0fb09e0a3f2102131
SHA1 d18e1da9e64ea280f971cd22096792367a89721c
SHA512 3ae79e3d722566ade4082f5be6bdea53a824ccb781d3fa02904a52bd807269ca94c7d0e47f105f900b944f8543543c1020673d22d452797643b5a0ae35c0fdb4
MD5 SHA1 SHA512

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 407KB
SHA256 e6164ff194fb651a44db5a78d680bc19efe242f3f8e95f5aedbe1cc7f00ef4ef
MD5 33dc7c00c1d64022dcea78d2147a90a5
SHA1 21b50a05d4bbfe74c1df846d9268dc953f8050a3
SHA512 3f5e3db56d056d49b094b33ddcdae8c528ec19851daa9576f00cb347f628b82bbe045fee51d92cf5507822188e5bce17b745cbc6bad155fae16b73eb191bb98f
SSDEEP 6144:cagzIsKGBJQyHDbmbJtkvePoxmaEJxGPHT/gVlNusm:IzI4JQkDaFtkoKmaMGR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TGHD.001

Path C:\Windows\SysWOW64\28463\TGHD.001
Size 474B
SHA256 3e9cdd5a89dd0115b1cf494bfea18c0c082ee11ef2857e5070a801c64c801e57
MD5 048fa939215692b9c56fe7538c183fed
SHA1 9a17270005e49fcd8e25f7d0fcfb27100644dd8a
SHA512 89010a2c2cbc7f9633815a36741a017201e2f235c1941712b72a6f82fc3d124d82331b2822a1c8399c9253d20a425bc76635344a14e84911abe45ff8a53d8e82
MD5 SHA1 SHA512

Submit Download

TGHD.006

Path C:\Windows\SysWOW64\28463\TGHD.006
Size 8KB
SHA256 894ff0262900acdc5b0266f75b2db829d3dec9a059f28888d5c0997d5b76db8a
MD5 8499922ab422c17e550a724083be50c7
SHA1 914aa24da69f9882d12d7d7cceae38de4dbcad1c
SHA512 9d2e7619c7e8e459449a7f70d581ae52a1d33ba1c90b2a14812c2a44474451dc06e78a8e410aae5e7caf9306bbe739b1eeca1a1bc167498a982d9f1320dbbd1b
SSDEEP 192:B3mZwiCbc31JY58VINWkoHqDH7yD6p99:mybU1JY5cbqU6p
MD5 SHA1 SHA512 SSDEEP

Submit Download

TGHD.007

Path C:\Windows\SysWOW64\28463\TGHD.007
Size 5KB
SHA256 b9939a330a7cf6d9947a2b3ffb52170a35d5927e401016e7694fdd24ba1aa4ef
MD5 b128c2f3eafaff6725ed554a2a21b72f
SHA1 377c206483b5348eb4b657363d29cae830be0b8c
SHA512 3de5ec44becf7520d7ae32764b4636a1d727ab92d192fd92d725d6d308067e331f88e62f3cd9a4a334eb1d9e2ea44bf30f14ebd4e4f2877cdbd6b7bf0ed771c8
SSDEEP 48:6gklbtCwgQEEiD4XAKaKzl/ab6dy2XBjAECi1cBaVM+kHTSoCE:6gS6Dgl/amXxsECiRQHTSof
MD5 SHA1 SHA512 SSDEEP

Submit Download

TGHD.exe

Path C:\Windows\SysWOW64\28463\TGHD.exe
Size 513KB
SHA256 800bdf00e09f302a17e22d26dffbea037e3c077ef9f6d1d585c114f079397a9e
MD5 0c7a714b8e1d2ead2afc90dcc43bbe18
SHA1 66736613f22771f5da5606ed8c80b572b3f5c103
SHA512 35db0de86c168eb6302dcbaa1e1f9ec96b5a8814e7067e1a7bb682e9f35fc06c51148a08e6f7df1e8caeb2effde555c53966a8922e8fef6b7ce194dc81c984b4
SSDEEP 6144:tkIahY1erZBfqalnScbMpmiYTEhkr6km7iADo/+V0NM/CAfr:tqY1er/nScw/uekrtAXj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fuckyou.exe

Path C:\fuckyou.exe
Size 507KB
SHA256 3282935f61fce9c4b41e6edc0b9245c0838a37df052b94f8bb969717a15d3654
MD5 a9973f96bcd8f536d3da80589a7a6f8c
SHA1 4914b550d0b7300acb6c04d6eff142a075c5b446
SHA512 002dd406f8df0a91a28350c922bb4aee489dd63704eb0567c63643190bbd3799c42f7c26f62c79b90580a586d5438bcdacff7b1d952f92e8ae1312d9bd6d332b
SSDEEP 12288:Id/IBtW7lKiiu3y/F75N0SD2KGXSAsyXsta0aQ9X2J:zSKih3y/F77DnDAlcta0aYGJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

raptor.bat

Path C:\raptor.bat
Size 39B
SHA256 2f3d164d2e98be3c7e337e6ddaa59ba4ee24a8b1bb89ae1a0700ad04a62a8285
MD5 52376672d6496e38fc7fd673f3060d10
SHA1 fac6bc2e05ba224fa7017ab1fb3c3c1b680de7b2
SHA512 330cea6ac57af77bbfd5b9540fd85ecd342f23c0d658b59b718d6bfca671ce70460bb20bbdf401ec6f32ff81cd80cc8c794d95b33e03dc555c530fa8d58e238d
MD5 SHA1 SHA512

Submit Download

memory/2652-9-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/2652-29-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/2652-26-0x0000000000690000-0x0000000000719000-memory.dmp

Download

memory/2652-10-0x0000000000690000-0x0000000000719000-memory.dmp

Download

memory/2652-0-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/2652-8-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/2652-7-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/2652-2-0x0000000000690000-0x0000000000719000-memory.dmp

Download

memory/4692-48-0x0000000000720000-0x0000000000721000-memory.dmp

Download

memory/4692-52-0x0000000000720000-0x0000000000721000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads