Analysis
-
max time kernel
137s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-01-2024 05:41
Static task
static1
Behavioral task
behavioral1
Sample
7689cfe186b8b43b5ac237f0d7ae3d13.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7689cfe186b8b43b5ac237f0d7ae3d13.exe
Resource
win10v2004-20231215-en
General
-
Target
7689cfe186b8b43b5ac237f0d7ae3d13.exe
-
Size
505KB
-
MD5
7689cfe186b8b43b5ac237f0d7ae3d13
-
SHA1
acf50b85df3c5ffe0be95c98458f19f413c53cb0
-
SHA256
78c94b57ea5e7dbf7c47bf19e7248d828a0669255dd2019cdf155d89b790d348
-
SHA512
6ce6061fd49e95da868bc0af8f763d66c20e365ed8f6cb1c91b5e58ea1aff57a98aafdd6147801758a8a3033b0f14a62ab27c3731830263c12fe16fda74dd468
-
SSDEEP
12288:OkKYVhaKByn4nfa+/EktpwsELreoOyyM/beuU:sY2KBy4y+/VpwZddy2qR
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\28463\AJAJ.exe family_ardamax -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7689cfe186b8b43b5ac237f0d7ae3d13.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 7689cfe186b8b43b5ac237f0d7ae3d13.exe -
Executes dropped EXE 1 IoCs
Processes:
AJAJ.exepid process 1068 AJAJ.exe -
Loads dropped DLL 4 IoCs
Processes:
7689cfe186b8b43b5ac237f0d7ae3d13.exeAJAJ.exepid process 1328 7689cfe186b8b43b5ac237f0d7ae3d13.exe 1068 AJAJ.exe 1068 AJAJ.exe 1068 AJAJ.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AJAJ.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AJAJ Agent = "C:\\Windows\\SysWOW64\\28463\\AJAJ.exe" AJAJ.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
7689cfe186b8b43b5ac237f0d7ae3d13.exeAJAJ.exedescription ioc process File created C:\Windows\SysWOW64\28463\AJAJ.006 7689cfe186b8b43b5ac237f0d7ae3d13.exe File created C:\Windows\SysWOW64\28463\AJAJ.007 7689cfe186b8b43b5ac237f0d7ae3d13.exe File created C:\Windows\SysWOW64\28463\AJAJ.exe 7689cfe186b8b43b5ac237f0d7ae3d13.exe File created C:\Windows\SysWOW64\28463\AKV.exe 7689cfe186b8b43b5ac237f0d7ae3d13.exe File opened for modification C:\Windows\SysWOW64\28463 AJAJ.exe File created C:\Windows\SysWOW64\28463\AJAJ.001 7689cfe186b8b43b5ac237f0d7ae3d13.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AJAJ.exedescription pid process Token: 33 1068 AJAJ.exe Token: SeIncBasePriorityPrivilege 1068 AJAJ.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AJAJ.exepid process 1068 AJAJ.exe 1068 AJAJ.exe 1068 AJAJ.exe 1068 AJAJ.exe 1068 AJAJ.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
7689cfe186b8b43b5ac237f0d7ae3d13.exedescription pid process target process PID 1328 wrote to memory of 1068 1328 7689cfe186b8b43b5ac237f0d7ae3d13.exe AJAJ.exe PID 1328 wrote to memory of 1068 1328 7689cfe186b8b43b5ac237f0d7ae3d13.exe AJAJ.exe PID 1328 wrote to memory of 1068 1328 7689cfe186b8b43b5ac237f0d7ae3d13.exe AJAJ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7689cfe186b8b43b5ac237f0d7ae3d13.exe"C:\Users\Admin\AppData\Local\Temp\7689cfe186b8b43b5ac237f0d7ae3d13.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\28463\AJAJ.exe"C:\Windows\system32\28463\AJAJ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD525530555085337eb644b061f239aa9d4
SHA18d91e099aba5439d4bfa8bce464c94e3e1acf620
SHA2563fb6b438ad1530abdd068bffb303fb8a4de51430e0e18ddb6b1a0469ffab8325
SHA512b1f9de0c276533a5a7070aeb2b6415cc1c0bdd2baf5e0645c6ac5ba767cab0d76e5b4461800d89724992af2c863294ada3c1eb2e4516183fe2010c33d47d6a2a
-
Filesize
446B
MD57f31d4225e4c9e1bd8bb9ac4ff526d4a
SHA1bca36835166510af37cc1df7fd8fc5a0996b0124
SHA256cb8a2a97d65e5066f4cdc1bed33546d7122863cde96c2e1df36bbcd521e184a9
SHA5124cce4b9de993792655fc0434ca286f7ed5f0b222c6cfe667351395a04d2abd0a44a3f57b884d7dc2bb977574c2125d74c4626f2a4f3494f1ce9c8d923852f056
-
Filesize
8KB
MD581e20f4361cf8f5a57812871c24d945e
SHA15d7877d6959ab26599b05795a71633f00c37a3da
SHA256e6e8b4a29dccb3531f58c75b754caf7f26afe3e7043239305fd0ae7ab2f7571d
SHA51269b1d75ab7123054bf98cf3a0f2cc7a0749cda8d85ebdef85be7d89f1454154ce29070907b934727a6c5276ff430e94810b87a5634d25d8529df9ee36fd20818
-
Filesize
5KB
MD5e9fbdcc2f5fb657fa519b3f5c69fc52d
SHA1c49cca77b46a59d620711de7564d43e5dafcd2b5
SHA256cc440cfc4ce1a1ff503cc9e8937c59aae64bfce4daa3e7dc757220a25cadc2e4
SHA512913759967e16b99d8ea66433e5dc99d5ddbf737be6784306e67c2b23a525b7a578fcae1028221d3209abc452ff30508eb750c62113c3868a7af36b544e525fb1
-
Filesize
473KB
MD597d8ad45f48b4b28a93aab94699b7168
SHA18b69b7fd7c008b95d12386f6da415097e72151de
SHA256661df22a66b2062b233eb0bd9665de924cfe0ac9c6ba29e20ffef24f817f9331
SHA5123351eac970bab391de410fcf1937da75d2e4722b808f10332f487ddfe469544e32e7d4ed0e5bdc19bd5f472cffcc55ca1498c95945b4e9c4ceff6ff5cc521c8a
-
Filesize
395KB
MD5d63cc8679a63448db1c64252e14e4ab5
SHA110b3a9ac4bc16e8ac1cd05e50b4d540fa3ef223e
SHA25629b3646a556879a4a48e4f2f81e09179c34ac2051ed3e4f4c28e293092470d3d
SHA512cb1911e1a77fb9be560aa4fd8bbef65e181b6d4438d65657501dbcd8dbf488ba01738a7222f35f8d4317e8df8c6f307d9e3623d6e3e45753e138b80fb68ff768