Analysis
- max time kernel
90s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
05/02/2024, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90bd6a2befe67eb6685e7a937e939357.exe
Resource
win7-20231215-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
90bd6a2befe67eb6685e7a937e939357.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 90bd6a2befe67eb6685e7a937e939357.exe
- Size 672KB
- Sample240205-cfrsmaaaap
- SHA256 97c9697556fe5859d26367d8b5df16c8e428786601ca21a445b5942cf1256f94
- MD5 90bd6a2befe67eb6685e7a937e939357
- SHA1 7613227f136ac40f3d4965a667d9548c2d43da83
- SHA512 ce4ec7f05848c4946fd0d45996921c704e9ed31c6ce3970ace7f07b85207c2dc8c375920859c266d9bb0b8a8aba5b834b5fd79b906f3727c454992a4c9b220d1
- SSDEEP 12288:k9ZlOgaHz2PzQufsSm9Zv0Nmh8rTHZCapTyeR49jLsm03LOb57vZVyfqA2pOTwL:kROggYul0NZrTHZRpvm03+DQfqA2MTwL
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x000600000002321d-33.dat family_ardamax - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 90bd6a2befe67eb6685e7a937e939357.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 90bd6a2befe67eb6685e7a937e939357.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation Exporer32.exe - Executes dropped EXE 2 IoCs
pid Process 1468 Exporer32.exe 4860 SECR.exe - Loads dropped DLL 4 IoCs
pid Process 1468 Exporer32.exe 4860 SECR.exe 4860 SECR.exe 4860 SECR.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SECR Agent = "C:\\Windows\\SysWOW64\\28463\\SECR.exe" SECR.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 90bd6a2befe67eb6685e7a937e939357.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 90bd6a2befe67eb6685e7a937e939357.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\SECR.006 Exporer32.exe File created C:\Windows\SysWOW64\28463\SECR.007 Exporer32.exe File created C:\Windows\SysWOW64\28463\SECR.exe Exporer32.exe File created C:\Windows\SysWOW64\28463\AKV.exe Exporer32.exe File opened for modification C:\Windows\SysWOW64\28463 SECR.exe File created C:\Windows\SysWOW64\28463\SECR.001 Exporer32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 90bd6a2befe67eb6685e7a937e939357.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 90bd6a2befe67eb6685e7a937e939357.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 90bd6a2befe67eb6685e7a937e939357.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe 3856 90bd6a2befe67eb6685e7a937e939357.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4860 SECR.exe Token: SeIncBasePriorityPrivilege 4860 SECR.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3856 90bd6a2befe67eb6685e7a937e939357.exe 4860 SECR.exe 4860 SECR.exe 4860 SECR.exe 4860 SECR.exe 4860 SECR.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3856 wrote to memory of 1468 3856 90bd6a2befe67eb6685e7a937e939357.exe 89 PID 3856 wrote to memory of 1468 3856 90bd6a2befe67eb6685e7a937e939357.exe 89 PID 3856 wrote to memory of 1468 3856 90bd6a2befe67eb6685e7a937e939357.exe 89 PID 1468 wrote to memory of 4860 1468 Exporer32.exe 93 PID 1468 wrote to memory of 4860 1468 Exporer32.exe 93 PID 1468 wrote to memory of 4860 1468 Exporer32.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\90bd6a2befe67eb6685e7a937e939357.exe"C:\Users\Admin\AppData\Local\Temp\90bd6a2befe67eb6685e7a937e939357.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\28463\SECR.exe"C:\Windows\system32\28463\SECR.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\jI82l\PCGWIN32.LI5
- Size 2KB
- SHA256 1bc880e9a519475110ceae6375cf4bae1111634c4f9c0abb6950fa6ec520f1b1
- MD5 d7abd328724d900b0ac6fa750f3b174f
- SHA1 834cb947da77f717cbdb86badccaf1fd3fb6eb5f
- SHA512 4dbe3988a3360f0618c21547829366ea37e92c3acf67213509e780ea892d06dd2ec8e32b97cc9f542306909fe2a395c7d73db3ac195d927d4cdab2b8b219db48
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\@5360.tmp
- Size 4KB
- SHA256 fd9c203a32eec0afe4ab1e3ae02c68ac27649120bb3f0af68852ba487384ecaf
- MD5 ac2120f3b2fb824a5c1f3752dc944d21
- SHA1 8bfbf3887103e886736e0802f88ed860a450856e
- SHA512 474d77a27e3553aa58b394e77317a770f700f59580820741269e6c4746e664ce483a33a51baecd45ef4ac1a13e451a2c47d95c9abb79c7bc5cf902646f78c90f
- SSDEEP 48:6mhIS9tRcE2bHmIhiwNK0e+mvt55kVIPKx5M9p1GO0HIr:6+/tRmCsibWi54rU1GTs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
- Size 496KB
- SHA256 c1236d25b0e7bacad481a861e1cabed3e6ce9704e4205142f536935cc9c10f7d
- MD5 691d771b1051bdda243e22407fb14aad
- SHA1 850d3f598eed8ad805800e0a4cf6b1a1e87275f2
- SHA512 448b16bcc4764dc900a8d5333b07474a95673935d01eeecff14464de0ad489a27365c43a6b75259a7aef76e4ce57b479f6c2e5010bbe589cb24afe64dd4340d5
- SSDEEP 6144:sdG6cHS2s9aDS0xG136sCkTD/AMF4d1/qvuw6gNK+AtFO85N8Acu3TLGVGEo5Cg5:sdOOaDS0xkq3+/St6b9u/OmeHa3EgFSA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\28463\AKV.exe
- Size 407KB
- SHA256 e6164ff194fb651a44db5a78d680bc19efe242f3f8e95f5aedbe1cc7f00ef4ef
- MD5 33dc7c00c1d64022dcea78d2147a90a5
- SHA1 21b50a05d4bbfe74c1df846d9268dc953f8050a3
- SHA512 3f5e3db56d056d49b094b33ddcdae8c528ec19851daa9576f00cb347f628b82bbe045fee51d92cf5507822188e5bce17b745cbc6bad155fae16b73eb191bb98f
- SSDEEP 6144:cagzIsKGBJQyHDbmbJtkvePoxmaEJxGPHT/gVlNusm:IzI4JQkDaFtkoKmaMGR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\28463\SECR.001
- Size 382B
- SHA256 f24d37f976ca4a2fbf71f59f6fe0c5a957c4906a8a13934a56bd863cdd94a0aa
- MD5 8ce28ec8fd1db9f5993d030f1709b61a
- SHA1 ce3263f190373bd800f73277c2f7373dff4c6b2a
- SHA512 d32ae9a7cad4680a3be1a2e28f3e342c303dc77be361e4b4844c392d00e7d387beaae5c9eda5b17a30024ae3c721fea821ced7c9556a19fe5bae0d995527a905
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\28463\SECR.006
- Size 8KB
- SHA256 894ff0262900acdc5b0266f75b2db829d3dec9a059f28888d5c0997d5b76db8a
- MD5 8499922ab422c17e550a724083be50c7
- SHA1 914aa24da69f9882d12d7d7cceae38de4dbcad1c
- SHA512 9d2e7619c7e8e459449a7f70d581ae52a1d33ba1c90b2a14812c2a44474451dc06e78a8e410aae5e7caf9306bbe739b1eeca1a1bc167498a982d9f1320dbbd1b
- SSDEEP 192:B3mZwiCbc31JY58VINWkoHqDH7yD6p99:mybU1JY5cbqU6p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\28463\SECR.007
- Size 5KB
- SHA256 b9939a330a7cf6d9947a2b3ffb52170a35d5927e401016e7694fdd24ba1aa4ef
- MD5 b128c2f3eafaff6725ed554a2a21b72f
- SHA1 377c206483b5348eb4b657363d29cae830be0b8c
- SHA512 3de5ec44becf7520d7ae32764b4636a1d727ab92d192fd92d725d6d308067e331f88e62f3cd9a4a334eb1d9e2ea44bf30f14ebd4e4f2877cdbd6b7bf0ed771c8
- SSDEEP 48:6gklbtCwgQEEiD4XAKaKzl/ab6dy2XBjAECi1cBaVM+kHTSoCE:6gS6Dgl/amXxsECiRQHTSof
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\28463\SECR.exe
- Size 513KB
- SHA256 800bdf00e09f302a17e22d26dffbea037e3c077ef9f6d1d585c114f079397a9e
- MD5 0c7a714b8e1d2ead2afc90dcc43bbe18
- SHA1 66736613f22771f5da5606ed8c80b572b3f5c103
- SHA512 35db0de86c168eb6302dcbaa1e1f9ec96b5a8814e7067e1a7bb682e9f35fc06c51148a08e6f7df1e8caeb2effde555c53966a8922e8fef6b7ce194dc81c984b4
- SSDEEP 6144:tkIahY1erZBfqalnScbMpmiYTEhkr6km7iADo/+V0NM/CAfr:tqY1er/nScw/uekrtAXj
- MD5 SHA1 SHA512 SSDEEP