ardamax | 11ef5e8bc8535c90bf67ad487313fcf9db5bdf724c7f683e8f35b122f80b2fff

General

Target
RAGNAR~1.exe
Size 496KB
Sample240114-ql2fxabfe8
SHA256 38426503e6797af6d0eba4b1504de5b4785548eb8c43f6e7c9320d11eacdf2cf
MD5 280c548e48051dd256fe9aa819b569e7
SHA1 ffbec20fc4d2895c6d3d28f78a70d4c39676424f
SHA512 9e84eb8551c5cf6b2ddedcff33bbf56cf021378b294f873f5ba7774a977919f78757ef501863ae15db94634a052a52c15d0ee64657b53869da4cbcb2d498d6c1
SSDEEP 12288:J6QJX4b8yQyg0k1FfoT9fsIITWBDxD1f4jBiRx1C+HdJAco:2Qygf6T9URKT1f0iv1C+TAX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015dbb-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2276	PXUY.exe

Loads dropped DLL 5 IoCs

pid	Process
2496	RAGNAR~1.exe
2496	RAGNAR~1.exe
2496	RAGNAR~1.exe
2276	PXUY.exe
2276	PXUY.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PXUY Agent = "C:\\Windows\\SysWOW64\\28463\\PXUY.exe"	PXUY.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\PXUY.exe	RAGNAR~1.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	RAGNAR~1.exe
File opened for modification	C:\Windows\SysWOW64\28463	PXUY.exe
File created	C:\Windows\SysWOW64\28463\PXUY.001	RAGNAR~1.exe
File created	C:\Windows\SysWOW64\28463\PXUY.006	RAGNAR~1.exe
File created	C:\Windows\SysWOW64\28463\PXUY.007	RAGNAR~1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2276	PXUY.exe
Token: SeIncBasePriorityPrivilege	2276	PXUY.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2276	PXUY.exe
2276	PXUY.exe
2276	PXUY.exe
2276	PXUY.exe
2276	PXUY.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2276	2496	RAGNAR~1.exe	28
PID 2496 wrote to memory of 2276	2496	RAGNAR~1.exe	28
PID 2496 wrote to memory of 2276	2496	RAGNAR~1.exe	28
PID 2496 wrote to memory of 2276	2496	RAGNAR~1.exe	28

C:\Users\Admin\AppData\Local\Temp\RAGNAR~1.exe
"C:\Users\Admin\AppData\Local\Temp\RAGNAR~1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\28463\PXUY.exe
  "C:\Windows\system32\28463\PXUY.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 408KB
SHA256 557cfe249fa1838dc600ca8b137b1dc2dde3d9552b9ee4186bdca34b0401164e
MD5 9f298a92f457a6c240b70393f336a17a
SHA1 1acfd6d9856cdd6ca71b6efcc55040e97904aa58
SHA512 17cb2cc5b337a2b55b94ccc3ce7661fe2b502ce309a012eabfd4d88797a85a3fe3dae53e34891e5b295f7764494836b62a0d24b0b03ac6c93f77cc1f5dd0484c
SSDEEP 6144:4rLyP7D8S/h6KYdSCbo2z03rgA4mVgV4Zn/NVEIIBZc:Ksgd7nzI74mw4kM
MD5 SHA1 SHA512 SSDEEP

Submit Download

PXUY.001

Path C:\Windows\SysWOW64\28463\PXUY.001
Size 564B
SHA256 98fa713cf12f4163e2b5c887996f23cc3a807ca950f929f17bf53f95bcbdd854
MD5 2649c62a34d3c1bbec0f1f244ca84961
SHA1 0b2ecd688ccaa60ead31b8f3207c79d4af57f47d
SHA512 3eab7f1066319ee0e023583d5c4f2b23eb7fa4423e0aaea099bfda263ae25a0260bf8a636b94bd39a95a802b150e2539b7a244076db89bbba11a865a9d702218
MD5 SHA1 SHA512

Submit Download

PXUY.006

Path C:\Windows\SysWOW64\28463\PXUY.006
Size 8KB
SHA256 af46dca2a4f77f0c977fec74312a41e20bd064bd2ca17bec0f09afd67d7e1e3d
MD5 75f215af21ded98ab7a1a2a0ea1f1a30
SHA1 e85649693a178064da1aa4cc7c8e34c92472ba0d
SHA512 1582847dae80134e5272fc1b125d6af13746263601ebc8b540ea5fd3e4fc0a05f6e783c59a6052b971efd15d26d9d55b86345292160e9c79041b7c57f9a74f54
SSDEEP 96:6Ch3etHrFZ3XmYpOCXFtPYH5+cwfsrq1cEIUoWkQjgKgHp1+2mIXT6pDOfj9:d3e5X2Y8CXjPYZ4hIhWkI2j+yD6pCj9
MD5 SHA1 SHA512 SSDEEP

Submit Download

PXUY.007

Path C:\Windows\SysWOW64\28463\PXUY.007
Size 5KB
SHA256 531958a2b1de11d2da2eb8a5409f57c1f31253f79f790473d0efc0ae5567b61f
MD5 528f383007234b421e3f1072fae5af11
SHA1 b19c49e17263d940ffa4d46c60a7cf2d03525f09
SHA512 d1813fc77b21ebcdada0cc9c410e533a39a436a038d91cb131bf03c987dab6e7e5b4c99f1a135adde84b4afcbd0a9f0f13931bae3c45c5782d7557fa620b4830
SSDEEP 48:6gklbv+o80EE/KD4XJaKzx/abWds2XBjAECi1cBaVM+kHZXSouE:6gS0DMFaq9xsECiRQHlSoz
MD5 SHA1 SHA512 SSDEEP

Submit Download

@81FC.tmp

Path \Users\Admin\AppData\Local\Temp\@81FC.tmp
Size 4KB
SHA256 2520256a587481813a5557e54a65f2fca97baee5df333102adfff2dbdabb4828
MD5 fc0fea286539e5d84ccf49020ca3823b
SHA1 d43711c776edf9a07abed6bb95ed4a0e45e14d52
SHA512 70e1a5ec247d5e3057fe19f7f34b31ee7a79ab16dca73794829d9d81e3ed891881df424f7aa44b9424550574ab61c95d376163b16080aa7cfd61e986e6988ea2
SSDEEP 48:6mhpauw9vN+HUubnxhd/Ne+mvt55kVDB5M9p1GVUHpr:6+uvNo73Rji5O7U1GMl
MD5 SHA1 SHA512 SSDEEP

Submit Download

PXUY.exe

Path \Windows\SysWOW64\28463\PXUY.exe
Size 513KB
SHA256 0b15e820894e38d036e75abd442e1cebbfb734c4a50fd0f3adcd3b77211caa5e
MD5 1800b0b263035d94f7bb5e9e70270032
SHA1 c8ba77fa2e414ad11e39a6493e15c078c99d80e6
SHA512 1431bedcba045f110354c7ec8a34ad5677447aa647581ebc86c25ee38397d2eff4b02d438227144b934ce65b26a2be65c44b761bd4b46518ff44ba6aaf06f29f
SSDEEP 6144:iyZLdJKAmxIwp5ouECDnecbnwONb4+on6AFZFeEizZKI/4VYNzTwAfr:i8mxIwp5zdbnwu9e9FZIzPj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2276-24-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/2276-27-0x0000000000290000-0x0000000000291000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads