ardamax | b905e8b101b30a7d52bd850df8f20281143cd8a654a0d9b8c98222890f1e073f

General

Target
592eace6c03b1d967a68cee2d10ced1e.exe
Size 1.1MB
Sample240113-tw22zadcb8
SHA256 b905e8b101b30a7d52bd850df8f20281143cd8a654a0d9b8c98222890f1e073f
MD5 592eace6c03b1d967a68cee2d10ced1e
SHA1 21f20aaee057bb0dcc0c719477c54d2ff358d9a0
SHA512 371ec06813818a8fcad8a71ec199a08c16167cb8d65211dd943307bada94d4bce1e3d89f262ac99e38de477e2460248a2cc55df03ae695a456af267bf9889370
SSDEEP 24576:364MVT73Y6teg4QWlnC75rN8ktup0a/UsCFD2Rc7E0VCyHuFVYSs:364MTjPeg4Nnk5xup0RBFDBE0oyHuFk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023226-8.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	592eace6c03b1d967a68cee2d10ced1e.exe

Executes dropped EXE 1 IoCs

pid	Process
2124	CWO.exe

Loads dropped DLL 1 IoCs

pid	Process
2124	CWO.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CWO Start = "C:\\Windows\\SysWOW64\\MNDMIL\\CWO.exe"	CWO.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MNDMIL\CWO.001	592eace6c03b1d967a68cee2d10ced1e.exe
File created	C:\Windows\SysWOW64\MNDMIL\CWO.002	592eace6c03b1d967a68cee2d10ced1e.exe
File created	C:\Windows\SysWOW64\MNDMIL\AKV.exe	592eace6c03b1d967a68cee2d10ced1e.exe
File created	C:\Windows\SysWOW64\MNDMIL\CWO.exe	592eace6c03b1d967a68cee2d10ced1e.exe
File opened for modification	C:\Windows\SysWOW64\MNDMIL\	CWO.exe
File created	C:\Windows\SysWOW64\MNDMIL\CWO.004	592eace6c03b1d967a68cee2d10ced1e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2124	CWO.exe
Token: SeIncBasePriorityPrivilege	2124	CWO.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2124	CWO.exe
2124	CWO.exe
2124	CWO.exe
2124	CWO.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2124	3624	592eace6c03b1d967a68cee2d10ced1e.exe	88
PID 3624 wrote to memory of 2124	3624	592eace6c03b1d967a68cee2d10ced1e.exe	88
PID 3624 wrote to memory of 2124	3624	592eace6c03b1d967a68cee2d10ced1e.exe	88

C:\Users\Admin\AppData\Local\Temp\592eace6c03b1d967a68cee2d10ced1e.exe
"C:\Users\Admin\AppData\Local\Temp\592eace6c03b1d967a68cee2d10ced1e.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\MNDMIL\CWO.exe
  "C:\Windows\system32\MNDMIL\CWO.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\MNDMIL\AKV.exe
Size 456KB
SHA256 71b3aecefd36e4855a369019ac5871c544d39f8889d23cd455466a24cdecce6b
MD5 51507d91d43683b9c4b8fafeb4d888f8
SHA1 ead2f68338da7af4720378cd46133589fc9405ba
SHA512 a5a7ff3f8ffb72719b7e2c9dc2719c99ea32bd68994918ea027c0d7d54cfe0c80bfd34486dd8d3cdd390376bc4c8d1f7d97de4b98b7d39a3e10c3e2682c07d1c
SSDEEP 6144:y7EZisRMjmdiQL5nA8TtWRR4aF2ypEu/IVgMxHHOwA1MZTLzaSzmCw:y7qRRVdiQVnAi0Wq2ySlp1w
MD5 SHA1 SHA512 SSDEEP

Submit Download

CWO.001

Path C:\Windows\SysWOW64\MNDMIL\CWO.001
Size 61KB
SHA256 7e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422
MD5 383d5f5d4240d590e7dec3f7312a4ac7
SHA1 f6bcade8d37afb80cf52a89b3e84683f4643fbce
SHA512 e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a
SSDEEP 768:oadkrNBhKs6gmch9lbKR1jX+SrhbRgQ2LE9+Qf5P/a9ZPmbWaMIjRFi3in85oQA:ENBhDUcfV2jJOQ24kQfkZPmbWllJ5Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

CWO.002

Path C:\Windows\SysWOW64\MNDMIL\CWO.002
Size 43KB
SHA256 e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e
MD5 93df156c4bd9d7341f4c4a4847616a69
SHA1 c7663b32c3c8e247bc16b51aff87b45484652dc1
SHA512 ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35
SSDEEP 768:JwdFarW7WyPyjWCiX41NHbCi2rFNF/IbXzm01WmzwMRNhm7:Jw3arWzUa4T+rFNF+LWMRNU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CWO.004

Path C:\Windows\SysWOW64\MNDMIL\CWO.004
Size 1KB
SHA256 2aa04ac93de5a2160dfca5362b5700b91fe482fe7791a2e8122540aeadea980e
MD5 baf4ba40c22c91f503f87d59aacd2786
SHA1 9d442181b68222f26d37be705fa64d8cd1393e2a
SHA512 6e599f685edcac427b25dc6065d3119b63adaedfd1a691638972b25be17df974185d8931acd21b48281d04ce93f2d1d67e5af9bfb5afd90bb1c1bd9245f13e91
MD5 SHA1 SHA512

Submit Download

CWO.exe

Path C:\Windows\SysWOW64\MNDMIL\CWO.exe
Size 1.7MB
SHA256 5a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32
MD5 3cd29c0df98a7aeb69a9692843ca3edb
SHA1 7c86aea093f1979d18901bd1b89a2b02a60ac3e2
SHA512 e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9
SSDEEP 49152:xFX9r4Bel8Wvu7Eol3Y9TUpnkZYYxAHq/HU17ztvhd22vqBP4O2WSK:xJ9rlKWvXol3RuxAHq/b1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2124-16-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/2124-18-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads