Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20-01-2024 08:40

General

  • Target

    69fad7d6792450fb7bf97b72852b0b0f.exe

  • Size

    478KB

  • MD5

    69fad7d6792450fb7bf97b72852b0b0f

  • SHA1

    9c5ff90156e0041d61fb3b7c522473437a13eb3f

  • SHA256

    25527da024d34cc3015815ddd8e0963705ba67a01ade3d18d0291520efa6b2f8

  • SHA512

    16b6630376c2df716cfeafffe1be3c6529bc44e3500002612a52637f10b951bdd43c3a43227c85ee7d7d28f6d420891034b853bc52d7092430690d4b733f1acb

  • SSDEEP

    12288:N9AQvCxJI4YQ9gF/4UddGpMRrmVkrTXWXBgVOiH2zEx:4QoJI4L9Md/wXBgVwzQ

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f.exe
    "C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2436
    • C:\Windows\SysWOW64\28463\WUBF.exe
      "C:\Windows\system32\28463\WUBF.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\WUBF.exe > nul
        3⤵
          PID:1276

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\28463\AKV.exe

      Filesize

      219KB

      MD5

      54fe8eaa9ee0817099f087873a03e13b

      SHA1

      a5720f21bca8a8703e6d89209926284de320b432

      SHA256

      91c746c2d25af7323199f5e51e0bc9f6da15ba437e74962260590cafca2aa5e1

      SHA512

      c9fc6d6b96a34b4e1e4635b72373ce1e521f344d7a8ae7ec0d2856bd46ed09baf24af6a56077220dfef1601000b9114d070f0296f5dea437a00e293dd582a6ef

    • C:\Windows\SysWOW64\28463\WUBF.001

      Filesize

      394B

      MD5

      50286c5ca86842ac5690b6fe4ed2ea2a

      SHA1

      13474fef03d3ef030b3f2c2c78f21557f7604f96

      SHA256

      623518707b4f389a146cf8ac05514da251c0a4cb923f94d5533ff720e411df71

      SHA512

      cbd06f6f8b6be028ca44b8699108bca5f9d95642511cadc7bfcc5f8e7b0b707bde707513a59e16fc1e44c66927f5e4e4822a2bd3cdbe80c92a074ab241ed400c

    • C:\Windows\SysWOW64\28463\WUBF.006

      Filesize

      7KB

      MD5

      e0fcfa7cad88d1a8a462cee6b06cf668

      SHA1

      a7e49078517abc929a6da261df06556c8f5a8cf0

      SHA256

      340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

      SHA512

      430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

    • C:\Windows\SysWOW64\28463\WUBF.007

      Filesize

      5KB

      MD5

      ca72cd485d116033f1b776903ce7ee0a

      SHA1

      85b0b73a75b0498f56200dd1a5cf0de5371e42a3

      SHA256

      e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

      SHA512

      8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

    • C:\Windows\SysWOW64\28463\WUBF.exe

      Filesize

      152KB

      MD5

      d6c68396fb7266ba1dcae09edf7217d4

      SHA1

      eba3435bedb9f69cba79557c23c156f7229ea54b

      SHA256

      8a5d13277573c89e19283a99aceffc7e0ab2cbc01bb7ee6970b08ba455ca437c

      SHA512

      4fe4429b7740b0f796194bdce1593245c60c4ca4acacf68c4f17ee39db007941b3048c3ddc97822bfab4e41f11605e9ab43875d8f2fc32881a3d68a820bb4e59

    • \Users\Admin\AppData\Local\Temp\@8891.tmp

      Filesize

      4KB

      MD5

      908f7f4b0cf93759447afca95cd84aa6

      SHA1

      d1903a49b211bcb4a460904019ee7441420aa961

      SHA256

      3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

      SHA512

      958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

    • \Windows\SysWOW64\28463\WUBF.exe

      Filesize

      472KB

      MD5

      d7bd4739313a8e2fc9e080b7d0ba13b2

      SHA1

      808fcbe663bc02780b1d9962873a1e3066d55f05

      SHA256

      c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b

      SHA512

      d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398

    • memory/2876-24-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/2876-27-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB