Malware Analysis Report

2024-10-18 23:04

Sample ID 240122-jjq4tsbgh4
Target 6f1b274afb60566d225a99686230e5fc
SHA256 68e97dd1957f856617147605fed67146f308e66a620bf871a282ee32468954eb
Tags
ardamax discovery keylogger persistence stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

68e97dd1957f856617147605fed67146f308e66a620bf871a282ee32468954eb

Threat Level: Known bad

The file 6f1b274afb60566d225a99686230e5fc was found to be: Known bad.

Malicious Activity Summary

ardamax discovery keylogger persistence stealer

Ardamax

Ardamax main executable

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-22 07:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-22 07:42

Reported

2024-01-22 07:44

Platform

win7-20231129-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe"

Signatures

Ardamax

keylogger stealer ardamax

Ardamax main executable

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GQH Start = "C:\\Windows\\PKSQOU\\GQH.exe" C:\Windows\PKSQOU\GQH.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\PKSQOU\AKV.exe C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A
File created C:\Windows\PKSQOU\GQH.exe C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A
File opened for modification C:\Windows\PKSQOU\ C:\Windows\PKSQOU\GQH.exe N/A
File created C:\Windows\PKSQOU\GQH.004 C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A
File created C:\Windows\PKSQOU\GQH.001 C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A
File created C:\Windows\PKSQOU\GQH.002 C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\PKSQOU\GQH.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\PKSQOU\GQH.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe

"C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe"

C:\Windows\PKSQOU\GQH.exe

"C:\Windows\PKSQOU\GQH.exe"

Network

N/A

Files

\Windows\PKSQOU\GQH.exe

MD5 7dc8f94e34ad6f38e94f957043c39617
SHA1 081a26dc478bd3de6f2889b9c8da8b2e79723d8b
SHA256 618fb51d23c0ca116dbd24dc5e0240ebda862e405283d64871549321fde08202
SHA512 539c239670369f34e7907d072bdf6b91becb927454db3212b0c307363289b1900edffa2f9fac22d3d14435fcee28b7bdeee1f039f027d74f84627c85774b9f56

\Windows\PKSQOU\GQH.001

MD5 513c67ebf0379f75a6920540283a4579
SHA1 2fe191acb478d62026a8dbf63f65619d168ddee6
SHA256 8f636876880c59251548fca626731e648553e0b81b02f4667c22cbfadfbd6e30
SHA512 2330f5bbd8d7de91473430bc35a125fe13b261afa5b4ef9533d4d6ebcde6cfe27f705fccbdefa092eb9123eb33dcc1448deab72adab981726517afe458beb01d

memory/2564-15-0x0000000000230000-0x0000000000231000-memory.dmp

C:\Windows\PKSQOU\GQH.004

MD5 654b8c8ab1402317ee9ca99b86323e72
SHA1 9ed07abda3afc7b6cdf64a13469b0f2715bcc4a9
SHA256 c1096420bbc655cc5cb2c327c38b3fae704fd1f755f74d1780e6ec673a0c88ce
SHA512 c08f3b0c00d7e928fd2f10bd2907e101701b72caeb00765b708d1c8adf020afc0366c93aab06e2befbf516a1218c31033cd1cf2eeebf2e9ef85b1817d715217c

C:\Windows\PKSQOU\GQH.002

MD5 1db8aa9ffda07a5f5559cbf25087147b
SHA1 eea77894bff8e24fb0861159927f67decb629184
SHA256 8cf369255b48195b8ecec1c7bf2e76924641880aa7311e6cf504ca534bbfcd62
SHA512 b9f80191dd8975c2e484eeec1bc7c6212d1b614061e69d96eda87b7a061a78a34de220f22607c3eb1c0fa37f152744a5c8f65a896e2884a9daf969db54a11704

C:\Windows\PKSQOU\AKV.exe

MD5 0725c70d7b45945089905464a2710dc8
SHA1 a47223eb378919afc8c2a6af6b031bca12eacaae
SHA256 5340cf0385c1ccf9a5f01e9bbcb68474d5760c1c60bd87772fbd8a498208a3c5
SHA512 3b95b3c582c2df9a59c2aaa5e9f04ea093dda8b53a7df4b966d46c6f61643e8beed3e3cca0e784301f5f14ea17e2520ecf10dca0ae805e5b31bd51ac94d10888

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-22 07:42

Reported

2024-01-22 07:44

Platform

win10v2004-20231222-en

Max time kernel

121s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe"

Signatures

Ardamax

keylogger stealer ardamax

Ardamax main executable

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GQH Start = "C:\\Windows\\PKSQOU\\GQH.exe" C:\Windows\PKSQOU\GQH.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\PKSQOU\GQH.001 C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A
File created C:\Windows\PKSQOU\GQH.002 C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A
File created C:\Windows\PKSQOU\AKV.exe C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A
File created C:\Windows\PKSQOU\GQH.exe C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A
File opened for modification C:\Windows\PKSQOU\ C:\Windows\PKSQOU\GQH.exe N/A
File created C:\Windows\PKSQOU\GQH.004 C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\PKSQOU\GQH.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\PKSQOU\GQH.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A
N/A N/A C:\Windows\PKSQOU\GQH.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe

"C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc.exe"

C:\Windows\PKSQOU\GQH.exe

"C:\Windows\PKSQOU\GQH.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp

Files

C:\Windows\PKSQOU\GQH.exe

MD5 7dc8f94e34ad6f38e94f957043c39617
SHA1 081a26dc478bd3de6f2889b9c8da8b2e79723d8b
SHA256 618fb51d23c0ca116dbd24dc5e0240ebda862e405283d64871549321fde08202
SHA512 539c239670369f34e7907d072bdf6b91becb927454db3212b0c307363289b1900edffa2f9fac22d3d14435fcee28b7bdeee1f039f027d74f84627c85774b9f56

C:\Windows\PKSQOU\GQH.004

MD5 654b8c8ab1402317ee9ca99b86323e72
SHA1 9ed07abda3afc7b6cdf64a13469b0f2715bcc4a9
SHA256 c1096420bbc655cc5cb2c327c38b3fae704fd1f755f74d1780e6ec673a0c88ce
SHA512 c08f3b0c00d7e928fd2f10bd2907e101701b72caeb00765b708d1c8adf020afc0366c93aab06e2befbf516a1218c31033cd1cf2eeebf2e9ef85b1817d715217c

C:\Windows\PKSQOU\GQH.002

MD5 1db8aa9ffda07a5f5559cbf25087147b
SHA1 eea77894bff8e24fb0861159927f67decb629184
SHA256 8cf369255b48195b8ecec1c7bf2e76924641880aa7311e6cf504ca534bbfcd62
SHA512 b9f80191dd8975c2e484eeec1bc7c6212d1b614061e69d96eda87b7a061a78a34de220f22607c3eb1c0fa37f152744a5c8f65a896e2884a9daf969db54a11704

memory/2836-16-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

C:\Windows\PKSQOU\GQH.001

MD5 513c67ebf0379f75a6920540283a4579
SHA1 2fe191acb478d62026a8dbf63f65619d168ddee6
SHA256 8f636876880c59251548fca626731e648553e0b81b02f4667c22cbfadfbd6e30
SHA512 2330f5bbd8d7de91473430bc35a125fe13b261afa5b4ef9533d4d6ebcde6cfe27f705fccbdefa092eb9123eb33dcc1448deab72adab981726517afe458beb01d

C:\Windows\PKSQOU\AKV.exe

MD5 0725c70d7b45945089905464a2710dc8
SHA1 a47223eb378919afc8c2a6af6b031bca12eacaae
SHA256 5340cf0385c1ccf9a5f01e9bbcb68474d5760c1c60bd87772fbd8a498208a3c5
SHA512 3b95b3c582c2df9a59c2aaa5e9f04ea093dda8b53a7df4b966d46c6f61643e8beed3e3cca0e784301f5f14ea17e2520ecf10dca0ae805e5b31bd51ac94d10888

memory/2836-18-0x0000000000BC0000-0x0000000000BC1000-memory.dmp