Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2024 07:09
Static task
static1
Behavioral task
behavioral1
Sample
6cad2f2b95241208391f267afc056409.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6cad2f2b95241208391f267afc056409.exe
Resource
win10v2004-20231215-en
General
-
Target
6cad2f2b95241208391f267afc056409.exe
-
Size
1.2MB
-
MD5
6cad2f2b95241208391f267afc056409
-
SHA1
4bd8e43a3e3055dda829698d5e4d823c6a1d8bc6
-
SHA256
f8c8d29b1b1c744c717cc37eb06eeff6c65ffba4014d3bb3ed8bc6d9393b4893
-
SHA512
89bdba042b9af4ba95bc2995ea8ebadb7e3affd0bbdb741f1f73d71d0d6ea68f00372364eca1ea6c09e83400ffcbbe229533878b225a70aff8b64e2cdd15dee7
-
SSDEEP
24576:U64MVTzeeYFOS0TaxrrBqDb8pTY69acNKAsRmwBJWXaYKs6tk46f8Z:U64MTqcS0TahM8NacNKAsswBJWKVlq8
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\RGRHDH\QXE.exe family_ardamax -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6cad2f2b95241208391f267afc056409.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 6cad2f2b95241208391f267afc056409.exe -
Executes dropped EXE 1 IoCs
Processes:
QXE.exepid process 2528 QXE.exe -
Loads dropped DLL 1 IoCs
Processes:
QXE.exepid process 2528 QXE.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
QXE.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QXE Start = "C:\\Windows\\SysWOW64\\RGRHDH\\QXE.exe" QXE.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
6cad2f2b95241208391f267afc056409.exeQXE.exedescription ioc process File created C:\Windows\SysWOW64\RGRHDH\AKV.exe 6cad2f2b95241208391f267afc056409.exe File created C:\Windows\SysWOW64\RGRHDH\QXE.exe 6cad2f2b95241208391f267afc056409.exe File opened for modification C:\Windows\SysWOW64\RGRHDH\ QXE.exe File created C:\Windows\SysWOW64\RGRHDH\QXE.004 6cad2f2b95241208391f267afc056409.exe File created C:\Windows\SysWOW64\RGRHDH\QXE.001 6cad2f2b95241208391f267afc056409.exe File created C:\Windows\SysWOW64\RGRHDH\QXE.002 6cad2f2b95241208391f267afc056409.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
QXE.exedescription pid process Token: 33 2528 QXE.exe Token: SeIncBasePriorityPrivilege 2528 QXE.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
QXE.exepid process 2528 QXE.exe 2528 QXE.exe 2528 QXE.exe 2528 QXE.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6cad2f2b95241208391f267afc056409.exedescription pid process target process PID 1736 wrote to memory of 2528 1736 6cad2f2b95241208391f267afc056409.exe QXE.exe PID 1736 wrote to memory of 2528 1736 6cad2f2b95241208391f267afc056409.exe QXE.exe PID 1736 wrote to memory of 2528 1736 6cad2f2b95241208391f267afc056409.exe QXE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cad2f2b95241208391f267afc056409.exe"C:\Users\Admin\AppData\Local\Temp\6cad2f2b95241208391f267afc056409.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\RGRHDH\QXE.exe"C:\Windows\system32\RGRHDH\QXE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD551507d91d43683b9c4b8fafeb4d888f8
SHA1ead2f68338da7af4720378cd46133589fc9405ba
SHA25671b3aecefd36e4855a369019ac5871c544d39f8889d23cd455466a24cdecce6b
SHA512a5a7ff3f8ffb72719b7e2c9dc2719c99ea32bd68994918ea027c0d7d54cfe0c80bfd34486dd8d3cdd390376bc4c8d1f7d97de4b98b7d39a3e10c3e2682c07d1c
-
Filesize
61KB
MD5383d5f5d4240d590e7dec3f7312a4ac7
SHA1f6bcade8d37afb80cf52a89b3e84683f4643fbce
SHA2567e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422
SHA512e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a
-
Filesize
43KB
MD593df156c4bd9d7341f4c4a4847616a69
SHA1c7663b32c3c8e247bc16b51aff87b45484652dc1
SHA256e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e
SHA512ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35
-
Filesize
1KB
MD559e08a7fc2921731ffd4edf22fb03729
SHA1cf733d9c8b6abfff1100e51e8ecaa12f21211329
SHA2560d39fed7617feeca64b47072ca5fed20a8bc3cadcbbd1bcb34a585e42beac3db
SHA51258e18fd1bd0b90b5e781eee77bd7272ec0b6f1bf73893791aeb7dbff7d302f6d081e43a5b19b4cfd5b6d0c061b1c5c9201a3f348c3e94b274346bf7674234330
-
Filesize
1.7MB
MD53cd29c0df98a7aeb69a9692843ca3edb
SHA17c86aea093f1979d18901bd1b89a2b02a60ac3e2
SHA2565a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32
SHA512e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9