ardamax | 3143909b3d25371f35a28d55ae07c891a7cf22f1720b1f6ec6cc24d8329e2aed

General

Target
5931d4ce4474f475285ae401210118ec.exe
Size 527KB
Sample240113-t2dassddb3
SHA256 3143909b3d25371f35a28d55ae07c891a7cf22f1720b1f6ec6cc24d8329e2aed
MD5 5931d4ce4474f475285ae401210118ec
SHA1 6fbc6a2eb5fa01b5df0328e44462c1cfab95da10
SHA512 3eee717922cd50349cf563a83ed32931a350a57f54cec371219bc51424f56567a5c1a32945f53f4469cbcee95bd792c90ee6aa81929f9784e8a2d7aea92b899c
SSDEEP 12288:+LAxXLLxMeMR/zKKjCy9/p4SmMFcvjxUeq9d9eGEbGn:Zx36YKjCyPXm1vqeqr9eGEbGn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000002320f-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	5931d4ce4474f475285ae401210118ec.exe

Executes dropped EXE 1 IoCs

pid	Process
4896	NFHU.exe

Loads dropped DLL 4 IoCs

pid	Process
2316	5931d4ce4474f475285ae401210118ec.exe
4896	NFHU.exe
4896	NFHU.exe
4896	NFHU.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NFHU Agent = "C:\\Windows\\SysWOW64\\YHF\\NFHU.exe"	NFHU.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\YHF	NFHU.exe
File created	C:\Windows\SysWOW64\YHF\NFHU.001	5931d4ce4474f475285ae401210118ec.exe
File created	C:\Windows\SysWOW64\YHF\NFHU.006	5931d4ce4474f475285ae401210118ec.exe
File created	C:\Windows\SysWOW64\YHF\NFHU.007	5931d4ce4474f475285ae401210118ec.exe
File created	C:\Windows\SysWOW64\YHF\NFHU.exe	5931d4ce4474f475285ae401210118ec.exe
File created	C:\Windows\SysWOW64\YHF\AKV.exe	5931d4ce4474f475285ae401210118ec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4896	NFHU.exe
Token: SeIncBasePriorityPrivilege	4896	NFHU.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4896	NFHU.exe
4896	NFHU.exe
4896	NFHU.exe
4896	NFHU.exe
4896	NFHU.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4896	2316	5931d4ce4474f475285ae401210118ec.exe	94
PID 2316 wrote to memory of 4896	2316	5931d4ce4474f475285ae401210118ec.exe	94
PID 2316 wrote to memory of 4896	2316	5931d4ce4474f475285ae401210118ec.exe	94

C:\Users\Admin\AppData\Local\Temp\5931d4ce4474f475285ae401210118ec.exe
"C:\Users\Admin\AppData\Local\Temp\5931d4ce4474f475285ae401210118ec.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\YHF\NFHU.exe
  "C:\Windows\system32\YHF\NFHU.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@7649.tmp

Path C:\Users\Admin\AppData\Local\Temp\@7649.tmp
Size 4KB
SHA256 73b7e30ad8c34db793eed457f4845d360e80e08738663f7e40e0f9c217a914c7
MD5 30bfd4514b7d7bf4feb29fa277a85704
SHA1 1de5fcd883a38190e8d3a020ef0b65ee9a8dd62d
SHA512 0a8dc5c73272577016830cfb6fad43906f63debee9630456336a08b88740109f2d88e9e79ee5ac14be48c715335bd731d99f9e022c09d1ee73e5b1436645b5b7
SSDEEP 48:6mh+jqw9v9yHUubnxhdzh/Xe+mbz52ztZh/35M9p1G/UHpr:6+ov9M731xZG56xJU1GSl
MD5 SHA1 SHA512 SSDEEP

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\YHF\AKV.exe
Size 416KB
SHA256 561bb8440fb91e21a3ce6dcc0ec2d06829003fcd1282d14283451e962bd30fac
MD5 4668b7f6816e3af3096c06f5480e5899
SHA1 ca2300c38cc073c2e0a9dddfbfec19cc1ccad510
SHA512 f949fdc2b4158a791a67c7c0a2ebc372668147d98331692887b4e607fd9bdd24d53a79d3934b6fc36980c5034c6d30a7c02fd95d6caa0e868bfa2e1e963ef1c4
SSDEEP 6144:HwsrkO6eeOoCWbSUx3hhbS+JhyKWr/GV1IAQT:QGkjOorrxH2+JF8
MD5 SHA1 SHA512 SSDEEP

Submit Download

NFHU.001

Path C:\Windows\SysWOW64\YHF\NFHU.001
Size 460B
SHA256 c827ef9d296c0d3fab9bf8b3089f7fe9bf758d187ec6da3c80d3fee42e67fb60
MD5 57559f5612e174beb96dd019d4e817ae
SHA1 311347275dd6111584dd9ff62b139930a80ba3ee
SHA512 8e958e4f4d043785f890b61b0ae874fdc5510b0ca014571cb7596e21b8be4d85b14c2e85646d02c5ce460844ed9f029bdaf3a9c8d0ae2b96db8ddc94b75dbc67
MD5 SHA1 SHA512

Submit Download

NFHU.006

Path C:\Windows\SysWOW64\YHF\NFHU.006
Size 8KB
SHA256 dc83deabf925d71c6e8596b33290020ee76ff3fbb909ad3a4e62f6924000f42c
MD5 8fb07f75858ce780589f73c560bed729
SHA1 ceb87f6a61636ea862f3042a18a09dbc89742bba
SHA512 31964cf1f0add8b98e5a13782867a636aa82a9bbcf24f2c36ca46dda1934fc0d830546c6e46c0b59903a0a29578ddd71b1a5885008f8ab837cb8987f25d9926a
SSDEEP 96:6jh3etCRSmZrXusXFtPYH5+cwfsrq1cEIUoWkQjogHp1+2mIXT6pDz9:O3eQlesXjPYZ4hIhWkIpj+yD6p39
MD5 SHA1 SHA512 SSDEEP

Submit Download

NFHU.007

Path C:\Windows\SysWOW64\YHF\NFHU.007
Size 5KB
SHA256 b0a9c55e49cc0aa6ebbec533e9c350adce4a78bca6bdbaa3ef5ee70a62eb53b8
MD5 12f0081516d47e47c4296c960fc6beea
SHA1 8b3c35d39eefe8b69ec58125a8e755576c5f527d
SHA512 ea90005dd6aa0bfa6a3cb233e4aadb39335bcdaa3722d038273719fcadd7ae71678e25f1e32ef01604a9646f5eee0ae0f6e78fc14869598e27a7b6b8c256daca
SSDEEP 48:6gklbx+weQEEiD4pAKaKzt/aeyYJsGAECi1cBaVM+kHjYoCE:6gSoDit/aqJsXECiRQHjYof
MD5 SHA1 SHA512 SSDEEP

Submit Download

NFHU.exe

Path C:\Windows\SysWOW64\YHF\NFHU.exe
Size 540KB
SHA256 9bfa43a345b1446984cd3e0c20896cc188b3c2c2f21fccb85227a662f38aa1f6
MD5 20b550c5d6d61aa1e1c464d366264c9e
SHA1 ee9e349bb73a70d0e6d5e0776dc959ea57f9d96c
SHA512 04f6ad21a0c90ac850c1646ca78a59709f7a9cacdaaab621f1258490df269f5d07e5d063b1d4244792f76360b797df228e476fbbd3419385ffeb7cae7748cc5e
SSDEEP 6144:0nGacPXliBFAu2BEt5G2xbkd+XA69lpcMn4Tk4ycwGy/KVHN9TvAfM8:1iBFAuYix40wwDc9FrwhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4896-23-0x0000000000650000-0x0000000000651000-memory.dmp

Download

memory/4896-27-0x0000000000650000-0x0000000000651000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads