ardamax | e27006aef7054dbe0ea5f27ad5ed098512e570a554d9d66945e4d6ee7d4bcd7a

General

Target
b42e7f259e423f9b61d08fcdb71b6816.exe
Size 499KB
Sample240305-jppg7aaa5w
SHA256 e27006aef7054dbe0ea5f27ad5ed098512e570a554d9d66945e4d6ee7d4bcd7a
MD5 b42e7f259e423f9b61d08fcdb71b6816
SHA1 646497d9302eed94ac757ca8081134787e4f7a68
SHA512 f1e8c7778b9e875330d9b2d04307a821761bddacd38ecde897ee059017981de3eb05d305ab61f7602fa08abe0f03288077ce0f091c36127d1222cc98c7fde274
SSDEEP 12288:tdE0x/PgAwfQVOfbP0covu2uWUrJffdPNZy:4MPgAykpubJHdPny
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023217-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	b42e7f259e423f9b61d08fcdb71b6816.exe

Executes dropped EXE 1 IoCs

pid	Process
1292	QDPN.exe

Loads dropped DLL 4 IoCs

pid	Process
2984	b42e7f259e423f9b61d08fcdb71b6816.exe
1292	QDPN.exe
1292	QDPN.exe
1292	QDPN.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QDPN Agent = "C:\\Windows\\SysWOW64\\28463\\QDPN.exe"	QDPN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\QDPN.001	b42e7f259e423f9b61d08fcdb71b6816.exe
File created	C:\Windows\SysWOW64\28463\QDPN.006	b42e7f259e423f9b61d08fcdb71b6816.exe
File created	C:\Windows\SysWOW64\28463\QDPN.007	b42e7f259e423f9b61d08fcdb71b6816.exe
File created	C:\Windows\SysWOW64\28463\QDPN.exe	b42e7f259e423f9b61d08fcdb71b6816.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	b42e7f259e423f9b61d08fcdb71b6816.exe
File opened for modification	C:\Windows\SysWOW64\28463	QDPN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1292	QDPN.exe
Token: SeIncBasePriorityPrivilege	1292	QDPN.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1292	QDPN.exe
1292	QDPN.exe
1292	QDPN.exe
1292	QDPN.exe
1292	QDPN.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1292	2984	b42e7f259e423f9b61d08fcdb71b6816.exe	94
PID 2984 wrote to memory of 1292	2984	b42e7f259e423f9b61d08fcdb71b6816.exe	94
PID 2984 wrote to memory of 1292	2984	b42e7f259e423f9b61d08fcdb71b6816.exe	94

C:\Users\Admin\AppData\Local\Temp\b42e7f259e423f9b61d08fcdb71b6816.exe
"C:\Users\Admin\AppData\Local\Temp\b42e7f259e423f9b61d08fcdb71b6816.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\28463\QDPN.exe
  "C:\Windows\system32\28463\QDPN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@33E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\@33E1.tmp
Size 4KB
SHA256 fd9c203a32eec0afe4ab1e3ae02c68ac27649120bb3f0af68852ba487384ecaf
MD5 ac2120f3b2fb824a5c1f3752dc944d21
SHA1 8bfbf3887103e886736e0802f88ed860a450856e
SHA512 474d77a27e3553aa58b394e77317a770f700f59580820741269e6c4746e664ce483a33a51baecd45ef4ac1a13e451a2c47d95c9abb79c7bc5cf902646f78c90f
SSDEEP 48:6mhIS9tRcE2bHmIhiwNK0e+mvt55kVIPKx5M9p1GO0HIr:6+/tRmCsibWi54rU1GTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 407KB
SHA256 e6164ff194fb651a44db5a78d680bc19efe242f3f8e95f5aedbe1cc7f00ef4ef
MD5 33dc7c00c1d64022dcea78d2147a90a5
SHA1 21b50a05d4bbfe74c1df846d9268dc953f8050a3
SHA512 3f5e3db56d056d49b094b33ddcdae8c528ec19851daa9576f00cb347f628b82bbe045fee51d92cf5507822188e5bce17b745cbc6bad155fae16b73eb191bb98f
SSDEEP 6144:cagzIsKGBJQyHDbmbJtkvePoxmaEJxGPHT/gVlNusm:IzI4JQkDaFtkoKmaMGR
MD5 SHA1 SHA512 SSDEEP

Submit Download

QDPN.001

Path C:\Windows\SysWOW64\28463\QDPN.001
Size 444B
SHA256 a1673aeecdd02372f93d95e402453a65d94035ac2e97fa3855762129b57374a2
MD5 8fdac84e011773f1138022bf9ec4c5cf
SHA1 3d1dc5354e53de72efc63dacdd43c72bb3c3e4e5
SHA512 6d534c76416909fa7dad4722d509d8ef1c8cc8c2515921126d6e9ee8ac965fcec40c689ce4199741a7e22398cd43d8a5f4972668b4fb2eca98c64a75cfab746e
MD5 SHA1 SHA512

Submit Download

QDPN.006

Path C:\Windows\SysWOW64\28463\QDPN.006
Size 8KB
SHA256 894ff0262900acdc5b0266f75b2db829d3dec9a059f28888d5c0997d5b76db8a
MD5 8499922ab422c17e550a724083be50c7
SHA1 914aa24da69f9882d12d7d7cceae38de4dbcad1c
SHA512 9d2e7619c7e8e459449a7f70d581ae52a1d33ba1c90b2a14812c2a44474451dc06e78a8e410aae5e7caf9306bbe739b1eeca1a1bc167498a982d9f1320dbbd1b
SSDEEP 192:B3mZwiCbc31JY58VINWkoHqDH7yD6p99:mybU1JY5cbqU6p
MD5 SHA1 SHA512 SSDEEP

Submit Download

QDPN.007

Path C:\Windows\SysWOW64\28463\QDPN.007
Size 5KB
SHA256 b9939a330a7cf6d9947a2b3ffb52170a35d5927e401016e7694fdd24ba1aa4ef
MD5 b128c2f3eafaff6725ed554a2a21b72f
SHA1 377c206483b5348eb4b657363d29cae830be0b8c
SHA512 3de5ec44becf7520d7ae32764b4636a1d727ab92d192fd92d725d6d308067e331f88e62f3cd9a4a334eb1d9e2ea44bf30f14ebd4e4f2877cdbd6b7bf0ed771c8
SSDEEP 48:6gklbtCwgQEEiD4XAKaKzl/ab6dy2XBjAECi1cBaVM+kHTSoCE:6gS6Dgl/amXxsECiRQHTSof
MD5 SHA1 SHA512 SSDEEP

Submit Download

QDPN.exe

Path C:\Windows\SysWOW64\28463\QDPN.exe
Size 513KB
SHA256 800bdf00e09f302a17e22d26dffbea037e3c077ef9f6d1d585c114f079397a9e
MD5 0c7a714b8e1d2ead2afc90dcc43bbe18
SHA1 66736613f22771f5da5606ed8c80b572b3f5c103
SHA512 35db0de86c168eb6302dcbaa1e1f9ec96b5a8814e7067e1a7bb682e9f35fc06c51148a08e6f7df1e8caeb2effde555c53966a8922e8fef6b7ce194dc81c984b4
SSDEEP 6144:tkIahY1erZBfqalnScbMpmiYTEhkr6km7iADo/+V0NM/CAfr:tqY1er/nScw/uekrtAXj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1292-23-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/1292-27-0x0000000000680000-0x0000000000681000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads