Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-01-2024 14:17
Static task
static1
Behavioral task
behavioral1
Sample
6fa3640b87e3fc4235541f837ce809f0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6fa3640b87e3fc4235541f837ce809f0.exe
Resource
win10v2004-20231222-en
General
-
Target
6fa3640b87e3fc4235541f837ce809f0.exe
-
Size
271KB
-
MD5
6fa3640b87e3fc4235541f837ce809f0
-
SHA1
3d80ccb4c551043d4f746916375461493abdf866
-
SHA256
27e944668c75a6ccd01bb5e97ee645132f8fbfd90da6a9380a92eb51f7827905
-
SHA512
ea7b5b3330695f9146d8d070ae0acfa70d9a99b57deaa9f8394a773bc753c13f02ed085327e5b5315f27ac4d54be6605d8ef40c33e31746968700da02e76a36d
-
SSDEEP
6144:7G6lOQ1h6AXTMn4uEF9+dCu7j2od7wcT5sF7xAzlRw:7/15XT4zx7iod7h5e7iC
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\28463\HOKL.exe family_ardamax -
Executes dropped EXE 1 IoCs
Processes:
HOKL.exepid process 2208 HOKL.exe -
Loads dropped DLL 5 IoCs
Processes:
6fa3640b87e3fc4235541f837ce809f0.exeHOKL.exepid process 1900 6fa3640b87e3fc4235541f837ce809f0.exe 1900 6fa3640b87e3fc4235541f837ce809f0.exe 1900 6fa3640b87e3fc4235541f837ce809f0.exe 2208 HOKL.exe 2208 HOKL.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HOKL.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HOKL Agent = "C:\\Windows\\SysWOW64\\28463\\HOKL.exe" HOKL.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
6fa3640b87e3fc4235541f837ce809f0.exeHOKL.exedescription ioc process File created C:\Windows\SysWOW64\28463\HOKL.001 6fa3640b87e3fc4235541f837ce809f0.exe File created C:\Windows\SysWOW64\28463\HOKL.006 6fa3640b87e3fc4235541f837ce809f0.exe File created C:\Windows\SysWOW64\28463\HOKL.007 6fa3640b87e3fc4235541f837ce809f0.exe File created C:\Windows\SysWOW64\28463\HOKL.exe 6fa3640b87e3fc4235541f837ce809f0.exe File opened for modification C:\Windows\SysWOW64\28463 HOKL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
HOKL.exedescription pid process Token: 33 2208 HOKL.exe Token: SeIncBasePriorityPrivilege 2208 HOKL.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
HOKL.exepid process 2208 HOKL.exe 2208 HOKL.exe 2208 HOKL.exe 2208 HOKL.exe 2208 HOKL.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6fa3640b87e3fc4235541f837ce809f0.exedescription pid process target process PID 1900 wrote to memory of 2208 1900 6fa3640b87e3fc4235541f837ce809f0.exe HOKL.exe PID 1900 wrote to memory of 2208 1900 6fa3640b87e3fc4235541f837ce809f0.exe HOKL.exe PID 1900 wrote to memory of 2208 1900 6fa3640b87e3fc4235541f837ce809f0.exe HOKL.exe PID 1900 wrote to memory of 2208 1900 6fa3640b87e3fc4235541f837ce809f0.exe HOKL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fa3640b87e3fc4235541f837ce809f0.exe"C:\Users\Admin\AppData\Local\Temp\6fa3640b87e3fc4235541f837ce809f0.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\28463\HOKL.exe"C:\Windows\system32\28463\HOKL.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392B
MD5b25268c585d62811e37981077ac364dd
SHA1edbda834345b40b89a158e4118776e70939ffef1
SHA25654a3959108737215b9ba183902ac45bd2e204007e66de339bee6cf058a848d11
SHA512a8d18a4c037bc2d98d3258567eda8da2abbadaab499b154158b86bef1d76e888d623bdb2a3b8f6c10313a30675c3f2c3cd432f854dc4013057e0622066922bec
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce