Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-01-2024 21:12
Behavioral task
behavioral1
Sample
6e088e7a3dc0f6811e96db94362db2c8.exe
Resource
win7-20231129-en
General
-
Target
6e088e7a3dc0f6811e96db94362db2c8.exe
-
Size
1.7MB
-
MD5
6e088e7a3dc0f6811e96db94362db2c8
-
SHA1
2aab096835b308f103d76da5a82d96b43737314e
-
SHA256
f6e495de196a7084dea401ecb9fc3e9a1e29a81ad3df0323806a923a64059c10
-
SHA512
4ba05a4462d3236657a40c0e6e2ec7005644d9e2031acc781ba8443b43b426636d0615d046216058bf278c2cd886e018fb61f165b57d214e5bc0de8b8b8aedbd
-
SSDEEP
49152:3R+AEwd5JnHiRdLO4I5/zl3677VD47zrzmpN+PigPCrQtIX2APJuXl:3YxwdfH8a4I5l677k5qrSOm1
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\28463\WGQS.exe family_ardamax -
Executes dropped EXE 2 IoCs
Processes:
INSTALL.EXEWGQS.exepid process 3028 INSTALL.EXE 2564 WGQS.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
6e088e7a3dc0f6811e96db94362db2c8.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Wine 6e088e7a3dc0f6811e96db94362db2c8.exe -
Loads dropped DLL 11 IoCs
Processes:
INSTALL.EXEWGQS.exeDllHost.exe6e088e7a3dc0f6811e96db94362db2c8.exepid process 3028 INSTALL.EXE 3028 INSTALL.EXE 3028 INSTALL.EXE 2564 WGQS.exe 2564 WGQS.exe 2564 WGQS.exe 2564 WGQS.exe 2728 DllHost.exe 2564 WGQS.exe 2316 6e088e7a3dc0f6811e96db94362db2c8.exe 2728 DllHost.exe -
Processes:
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x00000000005B7000-memory.dmp themida behavioral1/memory/2316-4-0x0000000000400000-0x00000000005B7000-memory.dmp themida behavioral1/memory/2316-45-0x0000000000400000-0x00000000005B7000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WGQS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WGQS Agent = "C:\\Windows\\SysWOW64\\28463\\WGQS.exe" WGQS.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
INSTALL.EXEWGQS.exedescription ioc process File created C:\Windows\SysWOW64\28463\WGQS.001 INSTALL.EXE File created C:\Windows\SysWOW64\28463\WGQS.006 INSTALL.EXE File created C:\Windows\SysWOW64\28463\WGQS.007 INSTALL.EXE File created C:\Windows\SysWOW64\28463\WGQS.exe INSTALL.EXE File created C:\Windows\SysWOW64\28463\AKV.exe INSTALL.EXE File opened for modification C:\Windows\SysWOW64\28463 WGQS.exe -
Drops file in Windows directory 1 IoCs
Processes:
6e088e7a3dc0f6811e96db94362db2c8.exedescription ioc process File created C:\Windows\INSTALL.EXE 6e088e7a3dc0f6811e96db94362db2c8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
WGQS.exedescription pid process Token: 33 2564 WGQS.exe Token: SeIncBasePriorityPrivilege 2564 WGQS.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2728 DllHost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WGQS.exepid process 2564 WGQS.exe 2564 WGQS.exe 2564 WGQS.exe 2564 WGQS.exe 2564 WGQS.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6e088e7a3dc0f6811e96db94362db2c8.exeINSTALL.EXEdescription pid process target process PID 2316 wrote to memory of 3028 2316 6e088e7a3dc0f6811e96db94362db2c8.exe INSTALL.EXE PID 2316 wrote to memory of 3028 2316 6e088e7a3dc0f6811e96db94362db2c8.exe INSTALL.EXE PID 2316 wrote to memory of 3028 2316 6e088e7a3dc0f6811e96db94362db2c8.exe INSTALL.EXE PID 2316 wrote to memory of 3028 2316 6e088e7a3dc0f6811e96db94362db2c8.exe INSTALL.EXE PID 2316 wrote to memory of 3028 2316 6e088e7a3dc0f6811e96db94362db2c8.exe INSTALL.EXE PID 2316 wrote to memory of 3028 2316 6e088e7a3dc0f6811e96db94362db2c8.exe INSTALL.EXE PID 2316 wrote to memory of 3028 2316 6e088e7a3dc0f6811e96db94362db2c8.exe INSTALL.EXE PID 3028 wrote to memory of 2564 3028 INSTALL.EXE WGQS.exe PID 3028 wrote to memory of 2564 3028 INSTALL.EXE WGQS.exe PID 3028 wrote to memory of 2564 3028 INSTALL.EXE WGQS.exe PID 3028 wrote to memory of 2564 3028 INSTALL.EXE WGQS.exe PID 3028 wrote to memory of 2564 3028 INSTALL.EXE WGQS.exe PID 3028 wrote to memory of 2564 3028 INSTALL.EXE WGQS.exe PID 3028 wrote to memory of 2564 3028 INSTALL.EXE WGQS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e088e7a3dc0f6811e96db94362db2c8.exe"C:\Users\Admin\AppData\Local\Temp\6e088e7a3dc0f6811e96db94362db2c8.exe"1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\INSTALL.EXE"C:\Windows\INSTALL.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\28463\WGQS.exe"C:\Windows\system32\28463\WGQS.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2564
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5687d9933624943e77e0d639a27e2dc51
SHA1e12e8f379c86982c53a2258a173524e146a0f111
SHA256f8c240c4c21d772850f55c23d49bc6e01195e6f41cdf7a0dffa1af750026bbb0
SHA51202b458aebae3d85a001f0f65384f0daeece9d6726efd3068b60947e210ae60bdfbc865ae8db32d975d3d0eb3d5c4c97aa576274c6f6ef490870e12f5b5e3b350
-
Filesize
480KB
MD598ec30e388040b2d6d113ba5dc684f74
SHA160373d7cf902d248eafd0644a8d61cfb38cc2057
SHA256e1c6967b1f1cb994d746b67bc8baf7c1a683bfbdd18ffd6f44a5f86946a3e1e5
SHA5125610a25a0ece9e7e906ba20b19faeb1f44ee2dab61c8edc7960a795fd00150ff8579882d08e8fc773b1db39461fb0428176d27793fa5e62b0d381cb218a0c569
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
424B
MD5e212a3850a57f23b3650c1d30a85d917
SHA13650abb4951a03cbfc36c19984a285dc921b875c
SHA2560543787655e47c225f8a8328249347698a8713727068304063560b4c60960301
SHA51255d2d84f896b81211af9316322657bbb472d453b7d714af43f944400a529b3f639f62c7f790482438e7ce396bbf86b7b846876a3650627461ce6735aa70ebb16
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8