ardamax | 27e944668c75a6ccd01bb5e97ee645132f8fbfd90da6a9380a92eb51f7827905

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6fa3640b87e3fc4235541f837ce809f0.exe
Size 271KB
Sample240122-rlt79shba2
SHA256 27e944668c75a6ccd01bb5e97ee645132f8fbfd90da6a9380a92eb51f7827905
MD5 6fa3640b87e3fc4235541f837ce809f0
SHA1 3d80ccb4c551043d4f746916375461493abdf866
SHA512 ea7b5b3330695f9146d8d070ae0acfa70d9a99b57deaa9f8394a773bc753c13f02ed085327e5b5315f27ac4d54be6605d8ef40c33e31746968700da02e76a36d
SSDEEP 6144:7G6lOQ1h6AXTMn4uEF9+dCu7j2od7wcT5sF7xAzlRw:7/15XT4zx7iod7h5e7iC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 3 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023156-12.dat	family_ardamax
behavioral2/files/0x0007000000023156-15.dat	family_ardamax
behavioral2/files/0x0007000000023156-14.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	6fa3640b87e3fc4235541f837ce809f0.exe

Executes dropped EXE 1 IoCs

pid	Process
4412	HOKL.exe

Loads dropped DLL 4 IoCs

pid	Process
2996	6fa3640b87e3fc4235541f837ce809f0.exe
4412	HOKL.exe
4412	HOKL.exe
4412	HOKL.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HOKL Agent = "C:\\Windows\\SysWOW64\\28463\\HOKL.exe"	HOKL.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\HOKL.001	6fa3640b87e3fc4235541f837ce809f0.exe
File created	C:\Windows\SysWOW64\28463\HOKL.006	6fa3640b87e3fc4235541f837ce809f0.exe
File created	C:\Windows\SysWOW64\28463\HOKL.007	6fa3640b87e3fc4235541f837ce809f0.exe
File created	C:\Windows\SysWOW64\28463\HOKL.exe	6fa3640b87e3fc4235541f837ce809f0.exe
File opened for modification	C:\Windows\SysWOW64\28463	HOKL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4412	HOKL.exe
Token: SeIncBasePriorityPrivilege	4412	HOKL.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4412	HOKL.exe
4412	HOKL.exe
4412	HOKL.exe
4412	HOKL.exe
4412	HOKL.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 4412	2996	6fa3640b87e3fc4235541f837ce809f0.exe	50
PID 2996 wrote to memory of 4412	2996	6fa3640b87e3fc4235541f837ce809f0.exe	50
PID 2996 wrote to memory of 4412	2996	6fa3640b87e3fc4235541f837ce809f0.exe	50

C:\Users\Admin\AppData\Local\Temp\6fa3640b87e3fc4235541f837ce809f0.exe
"C:\Users\Admin\AppData\Local\Temp\6fa3640b87e3fc4235541f837ce809f0.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\28463\HOKL.exe
  "C:\Windows\system32\28463\HOKL.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@50FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\@50FE.tmp
Size 4KB
SHA256 d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
MD5 c3679c3ff636d1a6b8c65323540da371
SHA1 d184758721a426467b687bec2a4acc80fe44c6f8
SHA512 494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
MD5 SHA1 SHA512

Submit Download

HOKL.001

Path C:\Windows\SysWOW64\28463\HOKL.001
Size 392B
SHA256 54a3959108737215b9ba183902ac45bd2e204007e66de339bee6cf058a848d11
MD5 b25268c585d62811e37981077ac364dd
SHA1 edbda834345b40b89a158e4118776e70939ffef1
SHA512 a8d18a4c037bc2d98d3258567eda8da2abbadaab499b154158b86bef1d76e888d623bdb2a3b8f6c10313a30675c3f2c3cd432f854dc4013057e0622066922bec
MD5 SHA1 SHA512

Submit Download

HOKL.006

Path C:\Windows\SysWOW64\28463\HOKL.006
Size 8KB
SHA256 3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
MD5 43f02e9974b1477c1e6388882f233db0
SHA1 f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA512 e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
SSDEEP 96:6ynh3GtCJk7eZjXOoP/YYfR+cwXofW1oEIYoWkQrWyHe1e2mIXT6pDw9:H3Ggk0+oP/YY50tI1WkQRoeyD6pU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOKL.007

Path C:\Windows\SysWOW64\28463\HOKL.007
Size 5KB
SHA256 a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
MD5 b5a87d630436f958c6e1d82d15f98f96
SHA1 d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA512 fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
SSDEEP 48:6gklbZREoW0EE/KD4tJaKz5/aSbRsEJZAECi1cBaVM+kHbDouE:6gSoDidaeJGECiRQHbDoz
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOKL.exe

Path C:\Windows\SysWOW64\28463\HOKL.exe
Size 349KB
SHA256 01dfe6bf3decb0445791ec01c0c5e02e8ad37a5a6e43a1a9d2178ffb0a0ac4e7
MD5 7b4a7886f756a0d4d968bf4f1b9743d7
SHA1 6e4119b2deb064e4c21d2469d3d49c8cd7238dbe
SHA512 4afd9d55b64d1411934f8680d81af854bf0416030395ac77e2192b8cf28391a181c6941eebf0ec7d3dfe4fe5ffdae6614d35870d0ba857074b7a9327a29b3ebb
SSDEEP 6144:gP/HgQr8z0psVGBJbsvUIvpBSkULIMxEIT:0gQNIGBJ/igkUYIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOKL.exe

Path C:\Windows\SysWOW64\28463\HOKL.exe
Size 343KB
SHA256 d08858109a542118d3367686157b9c8d7689f8ba318334475600db2bdb77eeea
MD5 145b2fc041b36d626097991d04523718
SHA1 59447ef7b56d5258d6eec5f474e85c32d7bab410
SHA512 c9c8fa7cf93f71ef0905526c3a0abe3b7c8b66cbddede0aae72a94667ac5263e013e1232ff1472d9c0bb1522e8fb442a3c3ad2d955eda8d9441ccbd88c84d7fe
SSDEEP 6144:gP/HgQr8z0psVGBJbsvUIvpBSkULIMxEIz:0gQNIGBJ/igkUYIz
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOKL.exe

Path C:\Windows\SysWOW64\28463\HOKL.exe
Size 393KB
SHA256 6d65cdd37ba2acbda1c77824a5a59c55f574c2ec230ab5130b4d76bf3d07e29a
MD5 0b4f8268577045d4198ca314ef419435
SHA1 06fd0d70b652830eef3e6022f2b4ac56d96cf694
SHA512 ff3aa38c664eba3d9564de3373d0d562559d74f65f6a1b2bc2f765d926f34ef808c6af78808a149bb42ea09d82a8a247c04284db52691dd8ad9bf53eded26143
SSDEEP 6144:gP/HgQr8z0psVGBJbsvUIvpBSkULIMxEIvs/IV2JNE:0gQNIGBJ/igkUYIp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4412-21-0x0000000000A70000-0x0000000000A71000-memory.dmp

Download

memory/4412-25-0x0000000000A70000-0x0000000000A71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads