ardamax | 7bfb50d5f82d0f807e5e179d0cf44d65068451d95e217b8b68fc3c4372995236

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e00e54479d218e50a55e497c2600948.exe
Size 2.4MB
Sample240204-c3gaeafdf6
SHA256 7bfb50d5f82d0f807e5e179d0cf44d65068451d95e217b8b68fc3c4372995236
MD5 8e00e54479d218e50a55e497c2600948
SHA1 01f2b7b68083770c037110ec4fd19dc84d03ef75
SHA512 e55ea16c60955ca20acef6da518fa428d2dd804f975c8bf3a63fc610cba5a37ac437135ce496e8889982d2584cfee38c6d705b9498cc9a80b3d13f4a0ab5459e
SSDEEP 49152:BiwHJXlGV+KUipeLzAFSirQAQK828oy4/w7OdYVhh78MTMeHn:BiCJ6NFrFSiroK828o07cYRKin
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023217-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8e00e54479d218e50a55e497c2600948.exe

Executes dropped EXE 2 IoCs

pid	Process
3248	FECN.exe
4896	installproXPN.exe

Loads dropped DLL 13 IoCs

pid	Process
4500	8e00e54479d218e50a55e497c2600948.exe
3248	FECN.exe
4896	installproXPN.exe
3248	FECN.exe
3248	FECN.exe
4896	installproXPN.exe
4896	installproXPN.exe
4896	installproXPN.exe
4896	installproXPN.exe
4896	installproXPN.exe
4896	installproXPN.exe
4896	installproXPN.exe
4896	installproXPN.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FECN Agent = "C:\\Windows\\SysWOW64\\28463\\FECN.exe"	FECN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\FECN.001	8e00e54479d218e50a55e497c2600948.exe
File created	C:\Windows\SysWOW64\28463\FECN.006	8e00e54479d218e50a55e497c2600948.exe
File created	C:\Windows\SysWOW64\28463\FECN.007	8e00e54479d218e50a55e497c2600948.exe
File created	C:\Windows\SysWOW64\28463\FECN.exe	8e00e54479d218e50a55e497c2600948.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	8e00e54479d218e50a55e497c2600948.exe
File opened for modification	C:\Windows\SysWOW64\28463	FECN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral2/files/0x000600000002321a-26.dat	nsis_installer_1
behavioral2/files/0x000600000002321a-26.dat	nsis_installer_2
behavioral2/files/0x000600000002321a-31.dat	nsis_installer_1
behavioral2/files/0x000600000002321a-31.dat	nsis_installer_2
behavioral2/files/0x000600000002321a-30.dat	nsis_installer_1
behavioral2/files/0x000600000002321a-30.dat	nsis_installer_2

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3248	FECN.exe
Token: SeIncBasePriorityPrivilege	3248	FECN.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3248	FECN.exe
3248	FECN.exe
3248	FECN.exe
3248	FECN.exe
3248	FECN.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3248	4500	8e00e54479d218e50a55e497c2600948.exe	83
PID 4500 wrote to memory of 3248	4500	8e00e54479d218e50a55e497c2600948.exe	83
PID 4500 wrote to memory of 3248	4500	8e00e54479d218e50a55e497c2600948.exe	83
PID 4500 wrote to memory of 4896	4500	8e00e54479d218e50a55e497c2600948.exe	84
PID 4500 wrote to memory of 4896	4500	8e00e54479d218e50a55e497c2600948.exe	84
PID 4500 wrote to memory of 4896	4500	8e00e54479d218e50a55e497c2600948.exe	84

C:\Users\Admin\AppData\Local\Temp\8e00e54479d218e50a55e497c2600948.exe
"C:\Users\Admin\AppData\Local\Temp\8e00e54479d218e50a55e497c2600948.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\28463\FECN.exe
  "C:\Windows\system32\28463\FECN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3248
- C:\Users\Admin\AppData\Local\Temp\installproXPN.exe
  "C:\Users\Admin\AppData\Local\Temp\installproXPN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@7A41.tmp

Path C:\Users\Admin\AppData\Local\Temp\@7A41.tmp
Size 4KB
SHA256 d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
MD5 c3679c3ff636d1a6b8c65323540da371
SHA1 d184758721a426467b687bec2a4acc80fe44c6f8
SHA512 494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
MD5 SHA1 SHA512

Submit Download

installproXPN.exe

Path C:\Users\Admin\AppData\Local\Temp\installproXPN.exe
Size 1.1MB
SHA256 51ab5a1084b88e8f3ec08768ffc4b50b71f40c206d9245163ba7a35b1034184d
MD5 7fcc6f15f84653d36c7d4555695d774e
SHA1 ddd68f32e9be492156c2a83e3304ad72b2e1ebcb
SHA512 ffd281fedfac32cf494e2f1471c739a32fad759d958c377f9a69e3071c93f3ced114b730ad03dd2e8f37b5919f98a8e34b4fe6e06b101be06daaa7b10eb474d6
SSDEEP 24576:0OdQmNPzJy2Y/nNiaCyNc0p8HpIr7ce026gYyzhc+v:VB4E/n0p6IrYeEeT
MD5 SHA1 SHA512 SSDEEP

Submit Download

installproXPN.exe

Path C:\Users\Admin\AppData\Local\Temp\installproXPN.exe
Size 673KB
SHA256 bcaef23a8356481f5b5b5348b0baf54c3f1271349278f6a609b184ec9135daf9
MD5 7ccfd5bf1c32f1c30172daf69ac2fddb
SHA1 587768fbc659d71266ac0bce82f73c47ac6268f1
SHA512 124a0ef229cf0920eee61f7034a66aff77dde3618d179d476405bc992a6efc06a76ae247738792f72103161561968f8ed8661acf85dbf976cba598cb37d87297
SSDEEP 12288:0X9wNHXltAmcPQltTXDcytI2rnM/3XNiaCy9zxJc0reQ8H8:0OdQmNPzJy2Y/nNiaCyNc0p8H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

installproXPN.exe

Path C:\Users\Admin\AppData\Local\Temp\installproXPN.exe
Size 1.0MB
SHA256 d8809670e8c3a42bb5423445fbe30c87a21eb070143c1a20a9b3419eeb9e2978
MD5 00a11cd54b0275e19c80bc951ec0e688
SHA1 b488a9ddafe7b4472ade77dc3f5b42526677f2a6
SHA512 71dd2f480f94f38a0f92d50751b673e38db11253c41524892416562814ea468b9f5911ea2634116a7ee9ac0f49a5f484732ff23ee09ac735bf00e1826617a487
SSDEEP 24576:0OdQmNPzJy2Y/nNiaCyNc0p8HpIr7ce026gYyzhcm:VB4E/n0p6IrYeEe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nss7F53.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nss7F53.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nss7F53.tmp\ioSpecial.ini
Size 596B
SHA256 a2f71cd45de6bfa978bba860075801af8770de38e40c5f437dbd72eca9a558b5
MD5 30838cc35dd8e14a442533f5b3f3e578
SHA1 c74872054d04039cb5bf7d43df4949e375c3d373
SHA512 7e5f7a074b6b2d622d4effccd7858073580846d3c3728767bcc6368e916bcfb40d28f315d9e8fe0ae8cdf371cfabc053b4e6bbfb2e0f66e48db18fb99cb5acbc
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nss7F53.tmp\ioSpecial.ini
Size 636B
SHA256 bbd552fd848d783cd4c1886e32bfdb3b1ce7949e2fe5a3dbe9e4262d0bad0079
MD5 115f89690690a726e4ed66d84728338f
SHA1 7cbd60bb57e8df6a0e92c3e65eec39939626daf8
SHA512 285e2adf7a8f75225b9dd30e662232dff0ffa7a771d0227661abab3d6677043ecb3647bf74cd4abcb1a0934e5e149ee1e119a7046d6ea2a466c788d033c034ab
MD5 SHA1 SHA512

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 395KB
SHA256 14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
MD5 b8fa30233794772b8b76b4b1d91c7321
SHA1 0cf9561be2528944285e536f41d502be24c3aa87
SHA512 10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
SSDEEP 6144:qXXNW/g8zSQbXumJZwsP2IUPNF/GVx8MFC:+XbySQjuG/P2bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

FECN.001

Path C:\Windows\SysWOW64\28463\FECN.001
Size 608B
SHA256 9fe90b4d93ebda05b769bdbb1b42d33c69e6c7539660a3da55ad0f8b630cb144
MD5 7a2259671d52f20636e5e256e102ad25
SHA1 a58bf4d2e2af1cb9ddae72872a112121afbf7956
SHA512 e521f1c157afe0302ae47538afe6e7fa3cc53fd5cace36e64fb55f4fe5cc7cb12afee14c43611e5eae32785a9ede7b0eb9ee3e6a376758c4efaff04eaba52920
MD5 SHA1 SHA512

Submit Download

FECN.006

Path C:\Windows\SysWOW64\28463\FECN.006
Size 8KB
SHA256 3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
MD5 43f02e9974b1477c1e6388882f233db0
SHA1 f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA512 e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
SSDEEP 96:6ynh3GtCJk7eZjXOoP/YYfR+cwXofW1oEIYoWkQrWyHe1e2mIXT6pDw9:H3Ggk0+oP/YY50tI1WkQRoeyD6pU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

FECN.007

Path C:\Windows\SysWOW64\28463\FECN.007
Size 5KB
SHA256 a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
MD5 b5a87d630436f958c6e1d82d15f98f96
SHA1 d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA512 fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
SSDEEP 48:6gklbZREoW0EE/KD4tJaKz5/aSbRsEJZAECi1cBaVM+kHbDouE:6gSoDidaeJGECiRQHbDoz
MD5 SHA1 SHA512 SSDEEP

Submit Download

FECN.exe

Path C:\Windows\SysWOW64\28463\FECN.exe
Size 473KB
SHA256 1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
MD5 17535dddecf8cb1efdba1f1952126547
SHA1 a862a9a3eb6c201751be1038537522a5281ea6cb
SHA512 b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8
SSDEEP 6144:gP/HgQr8z0psVGBJbsvUIvpBSkULIMxEIvs/IV2JN4Xd8Ab:0gQNIGBJ/igkUYItFb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3248-24-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/3248-131-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads