ardamax | db76a14e6a11affc071b6310898da2ee9b3112ea3e4d6f8969905bbcaf25dd9f

General

Target
b03224531388233708359c1005ef7e6b.exe
Size 1.2MB
Sample240301-dvxg4abf5t
SHA256 db76a14e6a11affc071b6310898da2ee9b3112ea3e4d6f8969905bbcaf25dd9f
MD5 b03224531388233708359c1005ef7e6b
SHA1 14d4f9ab95cb694af580d9b2c7f8d73723031091
SHA512 654efae9d1928a2bf7a76baa9bc0b714e5c23857fc509688b6aa4351eaa44efa10429608457ddd233a8459360bd7253248d035085c46d0ba4bc48605b76251ca
SSDEEP 24576:f64MVTpBTUAI3zGA8gtUTM857aX3YKTbdS25M5H7E4E6HJjDuXK0o53QPiEY:f64MTYR3zGU6MmaX3YkbAgM5Hw49JjD1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231e1-7.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	b03224531388233708359c1005ef7e6b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	FOI.exe

Executes dropped EXE 1 IoCs

pid	Process
384	FOI.exe

Loads dropped DLL 1 IoCs

pid	Process
384	FOI.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FOI Start = "C:\\Windows\\SysWOW64\\FNRSIY\\FOI.exe"	FOI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FNRSIY\FOI.004	b03224531388233708359c1005ef7e6b.exe
File created	C:\Windows\SysWOW64\FNRSIY\FOI.001	b03224531388233708359c1005ef7e6b.exe
File created	C:\Windows\SysWOW64\FNRSIY\FOI.002	b03224531388233708359c1005ef7e6b.exe
File created	C:\Windows\SysWOW64\FNRSIY\FOI.exe	b03224531388233708359c1005ef7e6b.exe
File opened for modification	C:\Windows\SysWOW64\FNRSIY\	FOI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	384	FOI.exe
Token: SeIncBasePriorityPrivilege	384	FOI.exe
Token: SeIncBasePriorityPrivilege	384	FOI.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
384	FOI.exe
384	FOI.exe
384	FOI.exe
384	FOI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 384	3192	b03224531388233708359c1005ef7e6b.exe	88
PID 3192 wrote to memory of 384	3192	b03224531388233708359c1005ef7e6b.exe	88
PID 3192 wrote to memory of 384	3192	b03224531388233708359c1005ef7e6b.exe	88
PID 384 wrote to memory of 1080	384	FOI.exe	96
PID 384 wrote to memory of 1080	384	FOI.exe	96
PID 384 wrote to memory of 1080	384	FOI.exe	96

C:\Users\Admin\AppData\Local\Temp\b03224531388233708359c1005ef7e6b.exe
"C:\Users\Admin\AppData\Local\Temp\b03224531388233708359c1005ef7e6b.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\FNRSIY\FOI.exe
  "C:\Windows\system32\FNRSIY\FOI.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\FNRSIY\FOI.exe > nul
    3⤵
    PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FOI.001

Path C:\Windows\SysWOW64\FNRSIY\FOI.001
Size 61KB
SHA256 7e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422
MD5 383d5f5d4240d590e7dec3f7312a4ac7
SHA1 f6bcade8d37afb80cf52a89b3e84683f4643fbce
SHA512 e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a
SSDEEP 768:oadkrNBhKs6gmch9lbKR1jX+SrhbRgQ2LE9+Qf5P/a9ZPmbWaMIjRFi3in85oQA:ENBhDUcfV2jJOQ24kQfkZPmbWllJ5Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

FOI.002

Path C:\Windows\SysWOW64\FNRSIY\FOI.002
Size 43KB
SHA256 e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e
MD5 93df156c4bd9d7341f4c4a4847616a69
SHA1 c7663b32c3c8e247bc16b51aff87b45484652dc1
SHA512 ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35
SSDEEP 768:JwdFarW7WyPyjWCiX41NHbCi2rFNF/IbXzm01WmzwMRNhm7:Jw3arWzUa4T+rFNF+LWMRNU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FOI.004

Path C:\Windows\SysWOW64\FNRSIY\FOI.004
Size 1KB
SHA256 9a6ea9b228f295dec4d50e1e89a90efc013a70cc4002fdd0c748ff07f652692d
MD5 a153a0fa66fd343057313ffa049a19d0
SHA1 dec6c7412a80dd5ee6aff12d79756e36eb5757fe
SHA512 64b28e9e9bec952f8c55663af0d5f870dc884f0caaed2ec058955f3eeda288c06c630bd453c8319b72890fb2add5d7671178c27744e872c9ca4950ef816adf69
MD5 SHA1 SHA512

Submit Download

FOI.exe

Path C:\Windows\SysWOW64\FNRSIY\FOI.exe
Size 1.7MB
SHA256 5a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32
MD5 3cd29c0df98a7aeb69a9692843ca3edb
SHA1 7c86aea093f1979d18901bd1b89a2b02a60ac3e2
SHA512 e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9
SSDEEP 49152:xFX9r4Bel8Wvu7Eol3Y9TUpnkZYYxAHq/HU17ztvhd22vqBP4O2WSK:xJ9rlKWvXol3RuxAHq/b1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-15-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads