Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-01-2024 08:40

General

  • Target

    69fad7d6792450fb7bf97b72852b0b0f.exe

  • Size

    478KB

  • MD5

    69fad7d6792450fb7bf97b72852b0b0f

  • SHA1

    9c5ff90156e0041d61fb3b7c522473437a13eb3f

  • SHA256

    25527da024d34cc3015815ddd8e0963705ba67a01ade3d18d0291520efa6b2f8

  • SHA512

    16b6630376c2df716cfeafffe1be3c6529bc44e3500002612a52637f10b951bdd43c3a43227c85ee7d7d28f6d420891034b853bc52d7092430690d4b733f1acb

  • SSDEEP

    12288:N9AQvCxJI4YQ9gF/4UddGpMRrmVkrTXWXBgVOiH2zEx:4QoJI4L9Md/wXBgVwzQ

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f.exe
    "C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\28463\WUBF.exe
      "C:\Windows\system32\28463\WUBF.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5044
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 1116
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:452
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\WUBF.exe > nul
        3⤵
          PID:3268
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5044 -ip 5044
      1⤵
        PID:3828

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\@C89F.tmp

        Filesize

        4KB

        MD5

        908f7f4b0cf93759447afca95cd84aa6

        SHA1

        d1903a49b211bcb4a460904019ee7441420aa961

        SHA256

        3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

        SHA512

        958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

      • C:\Windows\SysWOW64\28463\AKV.exe

        Filesize

        393KB

        MD5

        b0b09699ea39c0107af1c0833f07c054

        SHA1

        b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1

        SHA256

        be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1

        SHA512

        55430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796

      • C:\Windows\SysWOW64\28463\WUBF.001

        Filesize

        394B

        MD5

        50286c5ca86842ac5690b6fe4ed2ea2a

        SHA1

        13474fef03d3ef030b3f2c2c78f21557f7604f96

        SHA256

        623518707b4f389a146cf8ac05514da251c0a4cb923f94d5533ff720e411df71

        SHA512

        cbd06f6f8b6be028ca44b8699108bca5f9d95642511cadc7bfcc5f8e7b0b707bde707513a59e16fc1e44c66927f5e4e4822a2bd3cdbe80c92a074ab241ed400c

      • C:\Windows\SysWOW64\28463\WUBF.006

        Filesize

        7KB

        MD5

        e0fcfa7cad88d1a8a462cee6b06cf668

        SHA1

        a7e49078517abc929a6da261df06556c8f5a8cf0

        SHA256

        340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

        SHA512

        430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

      • C:\Windows\SysWOW64\28463\WUBF.007

        Filesize

        5KB

        MD5

        ca72cd485d116033f1b776903ce7ee0a

        SHA1

        85b0b73a75b0498f56200dd1a5cf0de5371e42a3

        SHA256

        e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

        SHA512

        8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

      • C:\Windows\SysWOW64\28463\WUBF.exe

        Filesize

        472KB

        MD5

        d7bd4739313a8e2fc9e080b7d0ba13b2

        SHA1

        808fcbe663bc02780b1d9962873a1e3066d55f05

        SHA256

        c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b

        SHA512

        d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398

      • memory/5044-23-0x0000000000C00000-0x0000000000C01000-memory.dmp

        Filesize

        4KB

      • memory/5044-27-0x0000000000C00000-0x0000000000C01000-memory.dmp

        Filesize

        4KB