ardamax | 776688479abfe7701fdb3ecd0a5be51903cefd12b556925593eee00694bf9945

General

Target

a2ec2c96e731a879ce78964658653922.exe
Size

1.2MB
MD5

a2ec2c96e731a879ce78964658653922
SHA1

19f2eddba4b5d8e7121077f47fd1640002bae773
SHA256

776688479abfe7701fdb3ecd0a5be51903cefd12b556925593eee00694bf9945
SHA512

c124c445663cb1703661467278e98969fa5443a563b7df4161c8bfb65e24129084edc306c3c520741279c3083cf95caf9b1ba6083df4f76f5b87f991add90ea7
SSDEEP

24576:EzwTT6sInNK2NsyYiX0oOEl9rg48I48rxVp5Id930tm26faWvAZiRzbtvO/:Ez+TwnN/YO00lpJD48LpGn0tH6fvDR

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016c84-6.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2436	APJ.exe

Loads dropped DLL 2 IoCs

pid	Process
2892	a2ec2c96e731a879ce78964658653922.exe
2436	APJ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\APJ Start = "C:\\Windows\\SysWOW64\\TAGPYH\\APJ.exe"	APJ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TAGPYH\AKV.exe	a2ec2c96e731a879ce78964658653922.exe
File created	C:\Windows\SysWOW64\TAGPYH\APJ.exe	a2ec2c96e731a879ce78964658653922.exe
File opened for modification	C:\Windows\SysWOW64\TAGPYH\	APJ.exe
File created	C:\Windows\SysWOW64\TAGPYH\APJ.004	a2ec2c96e731a879ce78964658653922.exe
File created	C:\Windows\SysWOW64\TAGPYH\APJ.001	a2ec2c96e731a879ce78964658653922.exe
File created	C:\Windows\SysWOW64\TAGPYH\APJ.002	a2ec2c96e731a879ce78964658653922.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2436	APJ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2436	APJ.exe
Token: SeIncBasePriorityPrivilege	2436	APJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2436	APJ.exe
2436	APJ.exe
2436	APJ.exe
2436	APJ.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2436	2892	a2ec2c96e731a879ce78964658653922.exe	28
PID 2892 wrote to memory of 2436	2892	a2ec2c96e731a879ce78964658653922.exe	28
PID 2892 wrote to memory of 2436	2892	a2ec2c96e731a879ce78964658653922.exe	28
PID 2892 wrote to memory of 2436	2892	a2ec2c96e731a879ce78964658653922.exe	28

C:\Users\Admin\AppData\Local\Temp\a2ec2c96e731a879ce78964658653922.exe
"C:\Users\Admin\AppData\Local\Temp\a2ec2c96e731a879ce78964658653922.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\TAGPYH\APJ.exe
  "C:\Windows\system32\TAGPYH\APJ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\TAGPYH\AKV.exe

Filesize
485KB

MD5
42150775d201a85ebc379d21aa253f85

SHA1
fccd7df34e16abaf8d55935016cdb15df8041e06

SHA256
00206ccef9ee8da111cc547c698b7e61736b328de48ac5c307d05f2921ef0b9c

SHA512
4ff3c587a8d88e319acb028829c75ecb3e11c16a62ba9c2090720613c51c6555af698ba8ff75672b405602f196ed1b99dbeb9395bae62aac2140fa31600b36e0

Download Submit
C:\Windows\SysWOW64\TAGPYH\APJ.001

Filesize
61KB

MD5
9681d3e1f2c53ad98b8467b3acca33fc

SHA1
04d5d08781f27d6e08ad0262f7325b2be4db7743

SHA256
baecddca15ea6932b9cd4e7f5bae848c3c290660a85c408b898150c6f8fd744e

SHA512
5c6191fb676ace9d1c2ddfd4e98651959ab24b718ab626c343e2bb271d31edd8ba43ed9de528c7832ddcc2137d2424c22bb19f115dc252e1400cfcd3edce2098

Download Submit
C:\Windows\SysWOW64\TAGPYH\APJ.002

Filesize
44KB

MD5
e65e4bdb2c86226589b88f101153c01b

SHA1
731be43621721dba20f0bb74966ea08043ef37fd

SHA256
e8a9477bc04824357c0f0bcc1cb665e1dfb6cf5c05f68517749f6cb11821cec2

SHA512
7700ee197f109a8f2cff2e529715e371e36c1d9924af0bedef9285f76898d3448847af3bff342813b9bd8ca619b7c39b9607150596008ffc6fe68b338f6769cd

Download Submit
C:\Windows\SysWOW64\TAGPYH\APJ.004

Filesize
1KB

MD5
1f83abd1d0a4e012bb06961ddc18e4b4

SHA1
ff1f168ed7bffb24eafa2e19830f8531aab05b24

SHA256
17e16865230ee3be1bc16d34861cca7188ec2a7afb539efbb23ffc7fab381811

SHA512
f48e4f45f036bfcc60411db0497996bd6a408b6118fca9d10a61ba0bd2fe9f91e2a2a3a1fde80c8e9110bfc6ce4e556842d9209e33dce82017057e70bf8d0c69

Download Submit
\Windows\SysWOW64\TAGPYH\APJ.exe

Filesize
1.7MB

MD5
9a6a50772539f5a61fefa29c34666223

SHA1
b2b8650d817ef7d86bfef48420e9716f0ffdccce

SHA256
93db12799d366bbb10f28b923188e3f1457b3ec931ddf33ddeb131a80e46f00b

SHA512
eb5f89e6b27981d85dc235edc477a4397d08b9e89d638b0e07301a26ca6e640f12251fdcfe1386df4167a2928bc60959289329531bc7a9e14a232ead22935fed

Download Submit
memory/2436-15-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2436-17-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads