ardamax | 86e004c6719c4825b8ed8bb1c8fd69789e5b6b0d6cb6a0ced644b829da12a6ed

General

Target
VirusShare-005bac8eebeef9b7ad5b9cd7c2f7cc31.exe
Size 611KB
Sample240202-2axjcsbgej
SHA256 86e004c6719c4825b8ed8bb1c8fd69789e5b6b0d6cb6a0ced644b829da12a6ed
MD5 005bac8eebeef9b7ad5b9cd7c2f7cc31
SHA1 e542c11e4d96465c751385e1c6e54724bf89882e
SHA512 1c86c425525818f212a05b3603ab776cb231ab29bd402262f6dbab0679c80b6fb4685bb84bc3a4a5a78e94373ac6afcc56b4a176c8745015e57075ada234ea3d
SSDEEP 12288:GGnhcIbSWjP9Zj1Ob8Vd5d0BwizaHKVGka0oOSElDbHeVm:7nPb9HRZPmwi0KVJbSWek
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000002321e-20.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	VirusShare-005bac8eebeef9b7ad5b9cd7c2f7cc31.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	Install.exe

Executes dropped EXE 2 IoCs

pid	Process
2212	Install.exe
3564	system32NOEJ.exe

Loads dropped DLL 2 IoCs

pid	Process
2212	Install.exe
3564	system32NOEJ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system32NOEJ Agent = "C:\\Windows\\system32NOEJ.exe"	system32NOEJ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32NOEJ.001	Install.exe
File created	C:\Windows\system32NOEJ.006	Install.exe
File created	C:\Windows\system32NOEJ.007	Install.exe
File created	C:\Windows\system32NOEJ.exe	Install.exe
File created	C:\Windows\system32AKV.exe	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3564	system32NOEJ.exe
Token: SeIncBasePriorityPrivilege	3564	system32NOEJ.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3564	system32NOEJ.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3564	system32NOEJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3564	system32NOEJ.exe
3564	system32NOEJ.exe
3564	system32NOEJ.exe
3564	system32NOEJ.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2212	4132	VirusShare-005bac8eebeef9b7ad5b9cd7c2f7cc31.exe	84
PID 4132 wrote to memory of 2212	4132	VirusShare-005bac8eebeef9b7ad5b9cd7c2f7cc31.exe	84
PID 4132 wrote to memory of 2212	4132	VirusShare-005bac8eebeef9b7ad5b9cd7c2f7cc31.exe	84
PID 2212 wrote to memory of 3564	2212	Install.exe	85
PID 2212 wrote to memory of 3564	2212	Install.exe	85
PID 2212 wrote to memory of 3564	2212	Install.exe	85

C:\Users\Admin\AppData\Local\Temp\VirusShare-005bac8eebeef9b7ad5b9cd7c2f7cc31.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare-005bac8eebeef9b7ad5b9cd7c2f7cc31.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32NOEJ.exe
    "C:\Windows\system32NOEJ.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@753F.tmp

Path C:\Users\Admin\AppData\Local\Temp\@753F.tmp
Size 4KB
SHA256 8165757efb79acceb9fd0bfae6b2c19b8f087cc0461abb17941d460dbdf2e260
MD5 d9e02f226fc338d14df200ba9a700625
SHA1 414f134a16a309b31e418ed9e08c0c48aaf6e2bc
SHA512 13c73381602fe2593312d41ab4bc5cd5f922ac651f9e71e3fe3c58e7f0c5c73ecc9d79d61ec46f33a0a81cf73373421eeb510bd99650c0f53af30974ed61b8ca
MD5 SHA1 SHA512

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\Install.exe
Size 500KB
SHA256 7e040cf2c5e7bd8014603e890dac698ac00676c161b1f37ab774f86bc5c0ba10
MD5 8ac978e7251b3152f573ec0b5fa2f0eb
SHA1 1aebbe226ce4a13bfb92f5d566df48e29948c0ee
SHA512 445b6b177fa395882ab911cfaa58613233df89b9084989ccd677cb2a720462510e6d992b9fe9cdfecf7d9a1fdfae9d5c251b55de0577e2077a85322171775f94
SSDEEP 12288:x/huIbFWjP9wj1OJ84d5O0BvizaPKKGka0oTSElvTHeVX:JFbMCRmQmviqKKJESWat
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32NOEJ.001

Path C:\Windows\system32NOEJ.001
Size 412B
SHA256 e917e4e582968948b0f74ee79b21e4b43d495bbcd6a5860578b7c9d817c49b97
MD5 64333f0044ad7ca2934dde5edcaad37c
SHA1 c5631e3b48d8ac3886f819fd6cfe5b8f3952afd5
SHA512 d274815b7d7135f0b6041fcc36dab3ec3662123e155274df00817f55ae2a03853b7d5fd523f16c44b5f5e6724416b96f19587b29bc3aab37ce762d171f4f9878
MD5 SHA1 SHA512

Submit Download

system32NOEJ.006

Path C:\Windows\system32NOEJ.006
Size 7KB
SHA256 6dcce9bbba5c2de47eea3abf7597a9c4fb2e4d358efc3752fa65c169cccfa2a1
MD5 32dd7b4bc8b6f290b0ece3cc1c011c96
SHA1 b979683868b399c6a6204ebaed9fc9c784a0429a
SHA512 9e0d720799fe816f7d09c8a722b762203b6f12a8625c1c93cd640219ecc35969bd641b4d9e6dc04ab6f95ceb73235a438eb7d48ee9402118db3618b5760551ea
SSDEEP 96:605h3mtCUYixcZQDXQHTcXXCYTJ+cwMswHO1yWCj0GMRZQfHY2mIXT6pDM05px:j3mPYkpAH4XyY1chCCRZY4yD6po05px
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32NOEJ.exe

Path C:\Windows\system32NOEJ.exe
Size 471KB
SHA256 e7f64e7215284cdeb8ef1eba28733f7aeae7f6977f82809d8de1e76a2e249085
MD5 3c06bbc025b61d2182ef5573f2852bda
SHA1 ebc1464c00b13fb5b3f80a59c80b595020e1fe7c
SHA512 9d839ada211b85fc1efb1fe7bb3ce66fcf0e8069221d958234649c2ac5dc0f1bd06f1a016f9c727077af36fb46cac5409be9c8a8201d17f689c6b473aa01acdc
SSDEEP 6144:zKUPSpAj+eoCqNZ+EI2vGbABvu7sOFCKK8vPntd/2VqNGu9c8Ab:Suj++EpvGyJOFCAgb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3564-28-0x0000000000770000-0x0000000000771000-memory.dmp

Download

memory/3564-32-0x0000000000770000-0x0000000000771000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads