ardamax | e5213f30aae396aa26326565a3baf243675769980db242a69565617d233099b9

General

Target
80049891c0070c6b8f3c0a08e6b13808.exe
Size 341KB
Sample240129-rch4mschal
SHA256 e5213f30aae396aa26326565a3baf243675769980db242a69565617d233099b9
MD5 80049891c0070c6b8f3c0a08e6b13808
SHA1 41a5733e46db48299acee063127be0574ff37f54
SHA512 344d34770a679e77118fdf491a03685bb7963d20604bfbcc44f6f69b07ae0120d2209682c215f20645322cf2dcb171bb3948d38c5c435fcd93f57b48e167972d
SSDEEP 6144:Fov6iKKjQJGjEH5WqvmlahXz/hMLUqswiu803uspOYKB1AbdBX96AEIlg+0WHLtw:6hKKkJd5nmshjpMLL+u80TvK3aXh1g+s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000002313a-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	80049891c0070c6b8f3c0a08e6b13808.exe

Executes dropped EXE 2 IoCs

pid	Process
2600	NNAQ.exe
388	MyMobster.exe

Loads dropped DLL 1 IoCs

pid	Process
4140	80049891c0070c6b8f3c0a08e6b13808.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\NNAQ.007	80049891c0070c6b8f3c0a08e6b13808.exe
File created	C:\Windows\SysWOW64\28463\NNAQ.exe	80049891c0070c6b8f3c0a08e6b13808.exe
File created	C:\Windows\SysWOW64\28463\NNAQ.001	80049891c0070c6b8f3c0a08e6b13808.exe
File created	C:\Windows\SysWOW64\28463\NNAQ.006	80049891c0070c6b8f3c0a08e6b13808.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
388	MyMobster.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2600	4140	80049891c0070c6b8f3c0a08e6b13808.exe	84
PID 4140 wrote to memory of 2600	4140	80049891c0070c6b8f3c0a08e6b13808.exe	84
PID 4140 wrote to memory of 2600	4140	80049891c0070c6b8f3c0a08e6b13808.exe	84
PID 4140 wrote to memory of 388	4140	80049891c0070c6b8f3c0a08e6b13808.exe	85
PID 4140 wrote to memory of 388	4140	80049891c0070c6b8f3c0a08e6b13808.exe	85
PID 4140 wrote to memory of 388	4140	80049891c0070c6b8f3c0a08e6b13808.exe	85

C:\Users\Admin\AppData\Local\Temp\80049891c0070c6b8f3c0a08e6b13808.exe
"C:\Users\Admin\AppData\Local\Temp\80049891c0070c6b8f3c0a08e6b13808.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\28463\NNAQ.exe
  "C:\Windows\system32\28463\NNAQ.exe"
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\MyMobster.exe
  "C:\Users\Admin\AppData\Local\Temp\MyMobster.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@C553.tmp

Path C:\Users\Admin\AppData\Local\Temp\@C553.tmp
Size 4KB
SHA256 a49cb9cbab2a60418b2079d4110123682fc980bb6b46ac5ada144797b5fa2cf4
MD5 9dc64557fcebd521ca4b267da15c2914
SHA1 c2247f9e0f0c8d11c7b9ab93f43ed53943d0bdd2
SHA512 00241a139ca307c5eb4d89fa8b6296833961091286282c3482746e4a3589ef61e6d007edb6aa6fa1ef812d57bf63a8e495e0db712e17decc77bbae2490cdbe01
MD5 SHA1 SHA512

Submit Download

MyMobster.exe

Path C:\Users\Admin\AppData\Local\Temp\MyMobster.exe
Size 220KB
SHA256 3867a334cefbee868af92fb739f426e436a2e774ab9e7f5dac3281ab253c8268
MD5 7f3f074deaf1ba6cba04475ca16e5f37
SHA1 1cd2f1b8ba359ac8f10d9b6026bc446a2b5b56d1
SHA512 083b6847a6d8fd227a4324ae20a724b5d9ded929c8b33c17bd3d5caaab311f50e23bf869aa926163d24dabed63b3d4817edff98402d368d49819789753938f0b
SSDEEP 3072:6WTrSNYC9NQibLAfdX9VBV+uDLlsst0dqTJJ5XZU:b2sdX9VBV+KLlft0dqTJJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

NNAQ.001

Path C:\Windows\SysWOW64\28463\NNAQ.001
Size 510B
SHA256 7261f2a699982df47d8a285dc8df96ec3d5a5f91f42386aa575a62597733aa63
MD5 6a2d3387df5af9cf4d47754d323162c4
SHA1 fafbfbd61a054e3490541d726f4a6637e125dbaa
SHA512 652886a0126461c910d570f4fa3509e42250dd1e0a833e474bd4a468b43af268501355bcbfd1b2dc2ba5d7d7c502fdb37ea11e6eb6a57252b31282408425c1fe
MD5 SHA1 SHA512

Submit Download

NNAQ.006

Path C:\Windows\SysWOW64\28463\NNAQ.006
Size 8KB
SHA256 b796bd1f5cdb1d1db91c3aca1ac700c015775b9caf2725fbf4b6089a096f21c5
MD5 86d96c93965255cef35ca42413188b75
SHA1 9d77f203267febe047d049584e5c79f1c1801b2d
SHA512 2db81080a16494ec549f4f39ee382580ba12cd5cbfe31632c8459ba94d767ce1ad3e9c0e6643f80530ae5e316fc42dca05708eeade7ce3c0341d669325cdb095
SSDEEP 96:6Mzh3GtHUedZQ3XQHI8QP/KYTJ+cwXofW1KWCj0+MRZQEUyHe1e2mIXT6pD3Ap:x3G5UjAHInP/KYF05CqRZP7oeyD6pc
MD5 SHA1 SHA512 SSDEEP

Submit Download

NNAQ.007

Path C:\Windows\SysWOW64\28463\NNAQ.007
Size 5KB
SHA256 4ba88f8964ee02a395d88974fd43b05610cf520b4ab40f36b3f98715ce1e0984
MD5 b73942c11844487ca7fc3e78062c8abb
SHA1 28f4c4159528ccbe9d83b5cd5e157861d11ff04c
SHA512 d4c782f5abd91b3396b243345f968eb5a705a7aefeedf92e62047309f7ccf223c0825623c184de66e3667c22eb371f0329be97ea70f6d72b54f98b22042e1f9c
SSDEEP 48:6gklbxQo80EE/KD4XJ2zxN03Uzdy2X3VIECi1cBaVM+kHXs:6gS0DMm03abnKECiRQHXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

NNAQ.exe

Path C:\Windows\SysWOW64\28463\NNAQ.exe
Size 472KB
SHA256 ded1c934280294375d7b926773511e4d5e6c8dbb22b0dd25a80a6b0b3af065d3
MD5 324154483b20e6f67a3c1486e3fc7c6a
SHA1 d6630eb1d8555b48413434b4a5d54c8de819cbf8
SHA512 36349f7c53b9989eac63e8c91b7fb009a5a0dce934242ae5956a5e3d3764949a87296adeba81f3da96b5e035f3755b4dd75de2ffa211b7db296313c52f6d478b
SSDEEP 6144:2BIhglmCAIoqDeLEQhb98+iyvqUFIraPQbCV/cVxNFqQwBUXAb:+l6jEQhIqqUFINWbZb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2600-33-0x0000000000490000-0x0000000000491000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads