ardamax | 91cbc24108759cc04e50c125a9096f1e41ca00ebb63f86b32bc760f8196596a5

General

Target
8e4a0596ed235b1438856bb1620dbd79.exe
Size 1.2MB
Sample240204-fr9pcscdhr
SHA256 91cbc24108759cc04e50c125a9096f1e41ca00ebb63f86b32bc760f8196596a5
MD5 8e4a0596ed235b1438856bb1620dbd79
SHA1 1972aef47b5cf1e122859dcc40244267e94d393d
SHA512 78b9fa76deaf1e567baf6c8e867ace2ff717fdccd45d656454f756e70da2fac4a14dc445d180d91ea62f164dde7d9653006b67b7e0921fe89034df83deb998a3
SSDEEP 24576:d0NzTm7zEtR6AtaBCo+A8FXFESOzhN+ZqDddN0hg9hQizpEzNv:d0pTmMv6nCo+AyXyS+KqT7M+E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000014be5-6.dat	family_ardamax
behavioral1/files/0x0007000000014be5-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2528	YJR.exe

Loads dropped DLL 2 IoCs

pid	Process
3028	8e4a0596ed235b1438856bb1620dbd79.exe
2528	YJR.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YJR Start = "C:\\Windows\\SysWOW64\\IDXEGP\\YJR.exe"	YJR.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IDXEGP\	YJR.exe
File created	C:\Windows\SysWOW64\IDXEGP\YJR.004	8e4a0596ed235b1438856bb1620dbd79.exe
File created	C:\Windows\SysWOW64\IDXEGP\YJR.001	8e4a0596ed235b1438856bb1620dbd79.exe
File created	C:\Windows\SysWOW64\IDXEGP\YJR.002	8e4a0596ed235b1438856bb1620dbd79.exe
File created	C:\Windows\SysWOW64\IDXEGP\AKV.exe	8e4a0596ed235b1438856bb1620dbd79.exe
File created	C:\Windows\SysWOW64\IDXEGP\YJR.exe	8e4a0596ed235b1438856bb1620dbd79.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2528	YJR.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2528	YJR.exe
Token: SeIncBasePriorityPrivilege	2528	YJR.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2528	YJR.exe
2528	YJR.exe
2528	YJR.exe
2528	YJR.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2528	3028	8e4a0596ed235b1438856bb1620dbd79.exe	28
PID 3028 wrote to memory of 2528	3028	8e4a0596ed235b1438856bb1620dbd79.exe	28
PID 3028 wrote to memory of 2528	3028	8e4a0596ed235b1438856bb1620dbd79.exe	28
PID 3028 wrote to memory of 2528	3028	8e4a0596ed235b1438856bb1620dbd79.exe	28

C:\Users\Admin\AppData\Local\Temp\8e4a0596ed235b1438856bb1620dbd79.exe
"C:\Users\Admin\AppData\Local\Temp\8e4a0596ed235b1438856bb1620dbd79.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\IDXEGP\YJR.exe
  "C:\Windows\system32\IDXEGP\YJR.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\IDXEGP\AKV.exe
Size 485KB
SHA256 ce666ce776c30251bb1b465d47826c23efaa86ec5ee50b2a4d23a4ceb343ed53
MD5 b905540561802896d1609a5709c38795
SHA1 a265f7c1d428ccece168d36ae1a5f50abfb69e37
SHA512 7663654f134f47a8092bae1f3f9d46732d2541ab955e7604d43a0def1e61e2bc039a6753e94d99f1d04b69f55a86f1fb937513671019f1bdf100edb97b24badc
SSDEEP 6144:D1uZZ4C38s2NRiiyfm45LBVuxJtdfsD66DPw9GfB/qVJM3HfACELcRkic:DkZZ4rFNVyfm45tVuzH2FDPw9GoCFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

YJR.002

Path C:\Windows\SysWOW64\IDXEGP\YJR.002
Size 43KB
SHA256 177c1dcc7f13158445f0b99713e9cad205da86e764940a48d43dc375565b0dec
MD5 f195701cf2c54d6ceadad943cf5135b8
SHA1 9beb03fc097fc58d7375b0511b87ced98a423a08
SHA512 f78def1ab431bb2b7b647ec76c063c30a87cabd22605f94cbe4fbb6f757fd54ddf7861d3842a0e369abfce94b68d41dec0fe2322a74f67d9875f561f92b20025
SSDEEP 768:XI8iyaeWPnnDxaPgc7nrjY1FKCaXfVttt2AJqgx301QqwMRg3vS:XI8iyaeWPnnwIsrsbEVttt2gEQIRg3v
MD5 SHA1 SHA512 SSDEEP

Submit Download

YJR.004

Path C:\Windows\SysWOW64\IDXEGP\YJR.004
Size 1KB
SHA256 a66acc2a2b2a923ff08dd7aa71c7479974d4332958d3ef643ca168cbbfac7186
MD5 de519db7ff426c5356b79bf25be72888
SHA1 a749db4ec534be6a4fead8081f926c851ea55a48
SHA512 70d2bcda3b383b8ae0dc9c72b9a47c4239dd6f224918cf3a4ec78df44b94524283be6966f48b9fa61db8be9cfd3b1e5c9de0b58ff3158ee406239df1073e11dc
MD5 SHA1 SHA512

Submit Download

YJR.exe

Path C:\Windows\SysWOW64\IDXEGP\YJR.exe
Size 1.6MB
SHA256 d7d21c09e8e037a254f9d57f023ef63b6da1569c736028a5c5243aabb9b246db
MD5 2f152a687cd203041f9640fc441ef569
SHA1 45044470470a34efc0aa11b3fafbba8b09ecb0fc
SHA512 f26c74444586792d1e584d484d6e8dc198e542848e407378a61adcf2189c43e5b2776309f8f1ce31df7a143cd23855b9bebeaf31d1c3bf45d5baa4e6527d3f50
SSDEEP 49152:0p2ZUfIIQDHWMVvC2nTlpnIZzBHsdRyxBT6+7z63Ysri5:0p23dDHpv30BHsfyxtd7z63Ysri5
MD5 SHA1 SHA512 SSDEEP

Submit Download

YJR.001

Path \Windows\SysWOW64\IDXEGP\YJR.001
Size 61KB
SHA256 c0f3e18ed0020dae5f75d3338b51f9c8de26d8af0a4d31904ba77cb1d112bbca
MD5 0e7e847fb96b4faa6cb4d3707a96887e
SHA1 896fd4064044e271312e9128e874108eec69521f
SHA512 ad680ed30b0cabe1be4e7237b8e620060de9c5f64d088d21a6acf6f293551ab4abc10f8f959aa6041e19aeaea538e72beeecc29b7669546a9a151141d4e73684
SSDEEP 768:DwbOJ9IBRWfyf6ggEcsC5bMfA+YRSJQ2LESeNVzDNjP0o4iycDFiq3857E43YG:0miBkaxcs/+IJQ24hjP0o4LHF57D3
MD5 SHA1 SHA512 SSDEEP

Submit Download

YJR.exe

Path \Windows\SysWOW64\IDXEGP\YJR.exe
Size 1.7MB
SHA256 cecfadce6fb09b3977c20d15fb40f8f66a1d7e488a4794451d048a598c3417da
MD5 d95623e481661c678a0546e02f10f24c
SHA1 b6949e68a19b270873764585eb1e82448d1e0717
SHA512 dee02644d92ed30e88bb10e9dcdba97abd9949b230059ec20cf5d93061f9cdb77b1e793e5f69d0b51595c30077c3ddd093348d22b070ce898ccefe28b8062591
SSDEEP 49152:0p2ZUfIIQDHWMVvC2nTlpnIZzBHsdRyxBT6+7z63YsriO0FVyo:0p23dDHpv30BHsfyxtd7z63YsriO0zyo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2528-15-0x0000000000240000-0x0000000000241000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads