ardamax | 52a7bc3076a283e7e35df3ef4572b775d1df8b76ca922b460256cc2e7c56ec58

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8477dfe1d828ff3fdd0b94b122ade1a.exe
Size 686KB
Sample240306-1pv4eabd3z
SHA256 52a7bc3076a283e7e35df3ef4572b775d1df8b76ca922b460256cc2e7c56ec58
MD5 b8477dfe1d828ff3fdd0b94b122ade1a
SHA1 437e5e12bb0d619b909a9a798b5978af5137391c
SHA512 9719a6219ac8c292bbf794ac2c4b0847a50d77e5b0a35693129629c450fa31f4756c9161138a5f3e942bc7315020b46c18a84f4954858367ece6deca4591806c
SSDEEP 12288:XE1D3uWAZLyyak5u9adRZAnADP7EP63skJdkWnJQL06/GLurjSWObQEPbYAnW0gK:BZTak0odHaAEy8IdkWJ2/GL6jSWObQEb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023240-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	b8477dfe1d828ff3fdd0b94b122ade1a.exe

Executes dropped EXE 1 IoCs

pid	Process
4368	GUQQ.exe

Loads dropped DLL 4 IoCs

pid	Process
3976	b8477dfe1d828ff3fdd0b94b122ade1a.exe
4368	GUQQ.exe
4368	GUQQ.exe
4368	GUQQ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUQQ Agent = "C:\\Windows\\SysWOW64\\28463\\GUQQ.exe"	GUQQ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\GUQQ.001	b8477dfe1d828ff3fdd0b94b122ade1a.exe
File created	C:\Windows\SysWOW64\28463\GUQQ.006	b8477dfe1d828ff3fdd0b94b122ade1a.exe
File created	C:\Windows\SysWOW64\28463\GUQQ.007	b8477dfe1d828ff3fdd0b94b122ade1a.exe
File created	C:\Windows\SysWOW64\28463\GUQQ.exe	b8477dfe1d828ff3fdd0b94b122ade1a.exe
File opened for modification	C:\Windows\SysWOW64\28463	GUQQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4368	GUQQ.exe
Token: SeIncBasePriorityPrivilege	4368	GUQQ.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4368	GUQQ.exe
4368	GUQQ.exe
4368	GUQQ.exe
4368	GUQQ.exe
4368	GUQQ.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4368	3976	b8477dfe1d828ff3fdd0b94b122ade1a.exe	100
PID 3976 wrote to memory of 4368	3976	b8477dfe1d828ff3fdd0b94b122ade1a.exe	100
PID 3976 wrote to memory of 4368	3976	b8477dfe1d828ff3fdd0b94b122ade1a.exe	100

C:\Users\Admin\AppData\Local\Temp\b8477dfe1d828ff3fdd0b94b122ade1a.exe
"C:\Users\Admin\AppData\Local\Temp\b8477dfe1d828ff3fdd0b94b122ade1a.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\28463\GUQQ.exe
  "C:\Windows\system32\28463\GUQQ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@ECB2.tmp

Path C:\Users\Admin\AppData\Local\Temp\@ECB2.tmp
Size 4KB
SHA256 27cfe74936e4090aafbef07ee45725923f4b1243135e1e3a51e3385dbcd7b637
MD5 a55cbc0f0125b005ef369020b4c17806
SHA1 010af3e2e84b337e91f5e0c791b01e1d527211ce
SHA512 88e5f7905c86d73bc5af028f20c8bf49f700307926c5b92814c245abe08e9c35841116d428ddbd7b957b47ccc8980684c12608b6818e4b6c1c8c0d27d54a07be
MD5 SHA1 SHA512

Submit Download

GUQQ.001

Path C:\Windows\SysWOW64\28463\GUQQ.001
Size 410B
SHA256 9c2c3a2f25d5b999e01dc240c6a5cb49901c82147bf6013cd20415fd3ece1bfe
MD5 747c3e9f62ee0d3b60eb8653fab7f1d6
SHA1 09cbe08661cf331b2ab3ed67d594e708c4956033
SHA512 21dac43cff41aff00abf4e9139d2c395dd07b9ca7738a0116fd6a6855b6816f2dcafff626f613fe37d0ab93ea2ae4e06be8be2cb53e06aaf16637652d594b5cc
MD5 SHA1 SHA512

Submit Download

GUQQ.006

Path C:\Windows\SysWOW64\28463\GUQQ.006
Size 8KB
SHA256 7c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1
MD5 395bbef326fa5ad1216b23f5debf167b
SHA1 aa4a7334b5a693b3f0d6f47b568e0d13a593d782
SHA512 dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679
SSDEEP 192:IVdg5cxPjOhoZHOiX+/yWDpQzWXEM1DOcQs8O+y:Ik5cpOhSuK+/ynMEQfQ3O
MD5 SHA1 SHA512 SSDEEP

Submit Download

GUQQ.007

Path C:\Windows\SysWOW64\28463\GUQQ.007
Size 5KB
SHA256 8f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e
MD5 1b5e72f0ebd49cf146f9ae68d792ffe5
SHA1 1e90a69c12b9a849fbbac0670296b07331c1cf87
SHA512 6364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc
SSDEEP 48:6mn/3+o80EE/KD4XJQK5Gaayko1vmiXdjAECihnm8mMWrlo0P:6m0DMWaavoFRNsECi9mbrlo
MD5 SHA1 SHA512 SSDEEP

Submit Download

GUQQ.exe

Path C:\Windows\SysWOW64\28463\GUQQ.exe
Size 912KB
SHA256 4cf4bf2b7d2bb4215e255e1f2b1238ad989f3c8a98ebfd5cb033bccf32fedaa0
MD5 6768ba61744862704760b66ce8f8fdd4
SHA1 e86cbed8cf20c2a9c76219d0c434bc310ffb2392
SHA512 eadb56b633707724ef4f47f8b421b0f3b2afa5a9800fae030f81aefae483eed6b494da470278273f388c3ae346a33cbbfe742924d231dab1c9b42bbefaf95a61
SSDEEP 12288:UiTqJKIx33aV1XINaXOq6xGJOpqtAnWGgAIb3NEnCztPvnK3STFi:F4KEnaVIa/0Gkp0AWG1Imw83OF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4368-16-0x0000000000400000-0x00000000004E3000-memory.dmp

Download

memory/4368-22-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/4368-26-0x0000000000400000-0x00000000004E3000-memory.dmp

Download

memory/4368-27-0x0000000000640000-0x0000000000641000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads