ardamax | fae7252ed994b1bc9e58cf13848c2aab33984c058a82102198b2ee928e67493a

General

Target
58613636824b792c643400dd4eb83689.exe
Size 968KB
Sample240113-jn8vfaeegr
SHA256 fae7252ed994b1bc9e58cf13848c2aab33984c058a82102198b2ee928e67493a
MD5 58613636824b792c643400dd4eb83689
SHA1 3e389ba974790143487e052f450aa3364c70bb46
SHA512 f09c60f309973f4195b773ecd037a2e4d784d2fa240090280dda6a93f84b7c58549521145a55feb091d3b5ed53369ddbf42426f10508da3f282dfccd3036e477
SSDEEP 24576:kDrTkLNK3ANVDRFnfKemOGytV/qQLINByAU4VYLUgtx:kXTX3A3bfV6Q91UyvWg3t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 3 IoCs

resource	yara_rule
behavioral2/files/0x000600000002320e-7.dat	family_ardamax
behavioral2/files/0x000600000002320e-9.dat	family_ardamax
behavioral2/files/0x000600000002320e-10.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	58613636824b792c643400dd4eb83689.exe

Executes dropped EXE 1 IoCs

pid	Process
2012	STF.exe

Loads dropped DLL 1 IoCs

pid	Process
2012	STF.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\STF Start = "C:\\Windows\\SysWOW64\\FYAGUI\\STF.exe"	STF.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FYAGUI\STF.004	58613636824b792c643400dd4eb83689.exe
File created	C:\Windows\SysWOW64\FYAGUI\STF.001	58613636824b792c643400dd4eb83689.exe
File created	C:\Windows\SysWOW64\FYAGUI\STF.002	58613636824b792c643400dd4eb83689.exe
File created	C:\Windows\SysWOW64\FYAGUI\STF.exe	58613636824b792c643400dd4eb83689.exe
File opened for modification	C:\Windows\SysWOW64\FYAGUI\	STF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2012	STF.exe
2012	STF.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2012	STF.exe
Token: SeIncBasePriorityPrivilege	2012	STF.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2012	STF.exe
2012	STF.exe
2012	STF.exe
2012	STF.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2012	748	58613636824b792c643400dd4eb83689.exe	89
PID 748 wrote to memory of 2012	748	58613636824b792c643400dd4eb83689.exe	89
PID 748 wrote to memory of 2012	748	58613636824b792c643400dd4eb83689.exe	89

C:\Users\Admin\AppData\Local\Temp\58613636824b792c643400dd4eb83689.exe
"C:\Users\Admin\AppData\Local\Temp\58613636824b792c643400dd4eb83689.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\FYAGUI\STF.exe
  "C:\Windows\system32\FYAGUI\STF.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

STF.001

Path C:\Windows\SysWOW64\FYAGUI\STF.001
Size 61KB
SHA256 b82f906b6429aa5c3df2dd7d2b61f33912c8db41ff783d35731050a024bc6420
MD5 da40e93ad90ab590fe53693447794639
SHA1 ecf59a5ecbd382191169eda65f86ea331dd08547
SHA512 87dbcbd1825ea71c78583680650236e8a8f8d4f718cf85f1542ed51fb1caaa4ff059ff0f201125564bcd80fa9d20c1d9ccd11e37133c7fef5ad30b27996f44e6
SSDEEP 768:FFG9ta2RlR27qDctmk0jP0ARzQ2LEGBLG1FczAiP5optmXFi5K385D4qnA:OXaayLtG3ZQ24GkQP5o7Rj5D4qA
MD5 SHA1 SHA512 SSDEEP

Submit Download

STF.002

Path C:\Windows\SysWOW64\FYAGUI\STF.002
Size 44KB
SHA256 dd81ace139ab0d6ca157775a5479fe6b94dc58de3a9bf81d39225967697cbcef
MD5 377ce908ebaea0de394f2e850ca6a26a
SHA1 d54276a5deeab532d5e5e3602e08d608e95c0707
SHA512 fda6bd43017754e7fa23037591073a52bdecac8629b5b2fe0eb924fd958dd450074b742ee94879430e0d4155efa9fc0a080b6dd035cf726cce3cb575ac6eb35f
SSDEEP 768:AKT4edoaqu7/fFPYEDmVIuLhCaU9NeIpAo8rZZ012RTMRSMyY:/Jdoaqu7l5ibu9NeIW2xRSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

STF.004

Path C:\Windows\SysWOW64\FYAGUI\STF.004
Size 1KB
SHA256 d6a0d38441fe4b8a47eb615973e523cf68c969e95f941618f3bbc6802ad17ae1
MD5 10ef36e4bdbee0402d897a7baef86c4d
SHA1 e640daa538be5c93c1d2cd65e1272c2237969d53
SHA512 62789b6d3da7003c8e7247acb869988315f91e21db52dcf7eabe0a084e3fceadc8716b95847ba8a1619704b5f8555cb774681f71243338aa0d2440caf37d1fb5
MD5 SHA1 SHA512

Submit Download

STF.exe

Path C:\Windows\SysWOW64\FYAGUI\STF.exe
Size 1024KB
SHA256 28ffe77232cc8743099c8ba7d2a8a454bbb99d969ed85033cf63f718ec1532a9
MD5 2f6be2a5a3aa2587a98b7e5e714a2d01
SHA1 1c06b57a75a2ae4f0b037251b3adf779a33f36e4
SHA512 69a84c96983c506d9a3eefdb34614cfb41badc39d2e315858d97fee0320efbb37cb4495fbef9deeab35bf2c94bae5cdfd3bc8e3cb9c0920ca1a82ecac68dacbf
SSDEEP 24576:BcpAubSye+FuKGxGoo5VwRePDh6+vPCbbIV3BtJ+LBn8PytL4v:PubSye+4wPmePQuflKt0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

STF.exe

Path C:\Windows\SysWOW64\FYAGUI\STF.exe
Size 1.0MB
SHA256 1436d46ed1dd9d952e0a2ded1ab6f4603eaf97bf4800ac505717130bcb39dc1c
MD5 f513ef1499a9f8fe5b093a3f4e1c9280
SHA1 b4ff09fb44ebb42cf564690f6b13fa87e083b32d
SHA512 5bc8369e195ea4f9c77b67a9a14a6883a5ff188ea6987378cac25b73603580571dad9eb2c789cc786a0e80d7f42f825b3bfc65599d3e9e1bd08572bdb2bbee33
SSDEEP 24576:BcpAubSye+FuKGxGoo5VwRePDh6+vPCbbIV3BtJ+LBn8PytL46:PubSye+4wPmePQuflKt06
MD5 SHA1 SHA512 SSDEEP

Submit Download

STF.exe

Path C:\Windows\SysWOW64\FYAGUI\STF.exe
Size 708KB
SHA256 6a5021bcd72690cfadbfcf8bc2b36f21295c58041635359de89a9eba81fe74cd
MD5 7d1f523472b9cb73126203cb33956fba
SHA1 4c6c4b26dbe9b44fdb8d3463f9349406632f67e9
SHA512 f7eb9da03f1b629fc8196b7851ce43228c418ba7f98c73988a1fa4a300c346a76ea4accb5b49338c8dea90124702dde371c8614ddb6d261a7a17ac6ff4365aff
SSDEEP 12288:d/KZ1vi7VuA2mONsjNUScXteF+FuKGxEHoo5VwR3OaKDhbWj+qdkB:BcpAubSye+FuKGxGoo5VwRePDh6+vB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2012-14-0x0000000000B70000-0x0000000000B71000-memory.dmp

Download

memory/2012-16-0x0000000000B70000-0x0000000000B71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads