Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2024 07:00
Static task
static1
Behavioral task
behavioral1
Sample
6ca8277f81969315d46d16c11c224055.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6ca8277f81969315d46d16c11c224055.exe
Resource
win10v2004-20231215-en
General
-
Target
6ca8277f81969315d46d16c11c224055.exe
-
Size
480KB
-
MD5
6ca8277f81969315d46d16c11c224055
-
SHA1
84cbcfe56fcb1672a05ecc8e3247c5233545404d
-
SHA256
2ca8f098f8f4d2b0cd89a7bc7531a413de711ec4e556fb1021cc185acb334ca7
-
SHA512
3683cac680eb81338ea7cd208082975e7cbee8fc27ad21bcd6ca7832f3603b32d5c9cd0c918ae8b6ec956bb9bba47a7a5f67d70b4bae1fac954ee1e79a53e6a4
-
SSDEEP
12288:JJXSZhHWrFmd5AV3YRI/gmDjF+W34zzdbuiOMYGNZ:ky8d5ACRI/VfkQYbgk
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\28463\MOOY.exe family_ardamax -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6ca8277f81969315d46d16c11c224055.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 6ca8277f81969315d46d16c11c224055.exe -
Executes dropped EXE 1 IoCs
Processes:
MOOY.exepid process 4992 MOOY.exe -
Loads dropped DLL 4 IoCs
Processes:
6ca8277f81969315d46d16c11c224055.exeMOOY.exepid process 2148 6ca8277f81969315d46d16c11c224055.exe 4992 MOOY.exe 4992 MOOY.exe 4992 MOOY.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MOOY.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MOOY Agent = "C:\\Windows\\SysWOW64\\28463\\MOOY.exe" MOOY.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
MOOY.exe6ca8277f81969315d46d16c11c224055.exedescription ioc process File opened for modification C:\Windows\SysWOW64\28463 MOOY.exe File created C:\Windows\SysWOW64\28463\MOOY.001 6ca8277f81969315d46d16c11c224055.exe File created C:\Windows\SysWOW64\28463\MOOY.006 6ca8277f81969315d46d16c11c224055.exe File created C:\Windows\SysWOW64\28463\MOOY.007 6ca8277f81969315d46d16c11c224055.exe File created C:\Windows\SysWOW64\28463\MOOY.exe 6ca8277f81969315d46d16c11c224055.exe File created C:\Windows\SysWOW64\28463\AKV.exe 6ca8277f81969315d46d16c11c224055.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MOOY.exedescription pid process Token: 33 4992 MOOY.exe Token: SeIncBasePriorityPrivilege 4992 MOOY.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
MOOY.exepid process 4992 MOOY.exe 4992 MOOY.exe 4992 MOOY.exe 4992 MOOY.exe 4992 MOOY.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6ca8277f81969315d46d16c11c224055.exedescription pid process target process PID 2148 wrote to memory of 4992 2148 6ca8277f81969315d46d16c11c224055.exe MOOY.exe PID 2148 wrote to memory of 4992 2148 6ca8277f81969315d46d16c11c224055.exe MOOY.exe PID 2148 wrote to memory of 4992 2148 6ca8277f81969315d46d16c11c224055.exe MOOY.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ca8277f81969315d46d16c11c224055.exe"C:\Users\Admin\AppData\Local\Temp\6ca8277f81969315d46d16c11c224055.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\28463\MOOY.exe"C:\Windows\system32\28463\MOOY.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
496B
MD53b95ae9d317fcdc571694ec6f78ce4e2
SHA1ac83887aab041c284c2f0dc835932f6060e2cc58
SHA2562fa8190aa0669643eede6d147e29e2ed9e63e98faa671c7f79ff76c959d2de9d
SHA512e442d8f57bda804375402609cbebcbcc8476dae0a1dfe9c682c5b64ba42cd4bc308007f76728452d25e390ea202ade033561e67d4e772ae2649dfa78505d8fe3
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8