Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2024 08:40
Static task
static1
Behavioral task
behavioral1
Sample
69fad7d6792450fb7bf97b72852b0b0f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
69fad7d6792450fb7bf97b72852b0b0f.exe
Resource
win10v2004-20231215-en
General
-
Target
69fad7d6792450fb7bf97b72852b0b0f.exe
-
Size
478KB
-
MD5
69fad7d6792450fb7bf97b72852b0b0f
-
SHA1
9c5ff90156e0041d61fb3b7c522473437a13eb3f
-
SHA256
25527da024d34cc3015815ddd8e0963705ba67a01ade3d18d0291520efa6b2f8
-
SHA512
16b6630376c2df716cfeafffe1be3c6529bc44e3500002612a52637f10b951bdd43c3a43227c85ee7d7d28f6d420891034b853bc52d7092430690d4b733f1acb
-
SSDEEP
12288:N9AQvCxJI4YQ9gF/4UddGpMRrmVkrTXWXBgVOiH2zEx:4QoJI4L9Md/wXBgVwzQ
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\28463\WUBF.exe family_ardamax -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
69fad7d6792450fb7bf97b72852b0b0f.exeWUBF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 69fad7d6792450fb7bf97b72852b0b0f.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation WUBF.exe -
Executes dropped EXE 1 IoCs
Processes:
WUBF.exepid process 5044 WUBF.exe -
Loads dropped DLL 5 IoCs
Processes:
69fad7d6792450fb7bf97b72852b0b0f.exeWUBF.exeWerFault.exepid process 2004 69fad7d6792450fb7bf97b72852b0b0f.exe 5044 WUBF.exe 5044 WUBF.exe 5044 WUBF.exe 452 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WUBF.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WUBF Agent = "C:\\Windows\\SysWOW64\\28463\\WUBF.exe" WUBF.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
69fad7d6792450fb7bf97b72852b0b0f.exeWUBF.exedescription ioc process File created C:\Windows\SysWOW64\28463\WUBF.exe 69fad7d6792450fb7bf97b72852b0b0f.exe File created C:\Windows\SysWOW64\28463\AKV.exe 69fad7d6792450fb7bf97b72852b0b0f.exe File opened for modification C:\Windows\SysWOW64\28463 WUBF.exe File created C:\Windows\SysWOW64\28463\WUBF.001 69fad7d6792450fb7bf97b72852b0b0f.exe File created C:\Windows\SysWOW64\28463\WUBF.006 69fad7d6792450fb7bf97b72852b0b0f.exe File created C:\Windows\SysWOW64\28463\WUBF.007 69fad7d6792450fb7bf97b72852b0b0f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 452 5044 WerFault.exe WUBF.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WUBF.exedescription pid process Token: 33 5044 WUBF.exe Token: SeIncBasePriorityPrivilege 5044 WUBF.exe Token: SeIncBasePriorityPrivilege 5044 WUBF.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WUBF.exepid process 5044 WUBF.exe 5044 WUBF.exe 5044 WUBF.exe 5044 WUBF.exe 5044 WUBF.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
69fad7d6792450fb7bf97b72852b0b0f.exeWUBF.exedescription pid process target process PID 2004 wrote to memory of 5044 2004 69fad7d6792450fb7bf97b72852b0b0f.exe WUBF.exe PID 2004 wrote to memory of 5044 2004 69fad7d6792450fb7bf97b72852b0b0f.exe WUBF.exe PID 2004 wrote to memory of 5044 2004 69fad7d6792450fb7bf97b72852b0b0f.exe WUBF.exe PID 5044 wrote to memory of 3268 5044 WUBF.exe cmd.exe PID 5044 wrote to memory of 3268 5044 WUBF.exe cmd.exe PID 5044 wrote to memory of 3268 5044 WUBF.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f.exe"C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\28463\WUBF.exe"C:\Windows\system32\28463\WUBF.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 11163⤵
- Loads dropped DLL
- Program crash
PID:452 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\WUBF.exe > nul3⤵PID:3268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5044 -ip 50441⤵PID:3828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5908f7f4b0cf93759447afca95cd84aa6
SHA1d1903a49b211bcb4a460904019ee7441420aa961
SHA2563e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23
SHA512958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d
-
Filesize
393KB
MD5b0b09699ea39c0107af1c0833f07c054
SHA1b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1
SHA256be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1
SHA51255430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796
-
Filesize
394B
MD550286c5ca86842ac5690b6fe4ed2ea2a
SHA113474fef03d3ef030b3f2c2c78f21557f7604f96
SHA256623518707b4f389a146cf8ac05514da251c0a4cb923f94d5533ff720e411df71
SHA512cbd06f6f8b6be028ca44b8699108bca5f9d95642511cadc7bfcc5f8e7b0b707bde707513a59e16fc1e44c66927f5e4e4822a2bd3cdbe80c92a074ab241ed400c
-
Filesize
7KB
MD5e0fcfa7cad88d1a8a462cee6b06cf668
SHA1a7e49078517abc929a6da261df06556c8f5a8cf0
SHA256340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4
SHA512430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82
-
Filesize
5KB
MD5ca72cd485d116033f1b776903ce7ee0a
SHA185b0b73a75b0498f56200dd1a5cf0de5371e42a3
SHA256e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4
SHA5128dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f
-
Filesize
472KB
MD5d7bd4739313a8e2fc9e080b7d0ba13b2
SHA1808fcbe663bc02780b1d9962873a1e3066d55f05
SHA256c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b
SHA512d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398