Overview

overview

10

Static

static

3

dd660708c5...70.exe

windows7-x64

10

dd660708c5...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd660708c5811aebefce5e821fdcdb70

  • Size

    348KB

  • Sample

    240325-gphnjahf97

  • MD5

    dd660708c5811aebefce5e821fdcdb70

  • SHA1

    e6b6e5ba172faf74dca302f49276bcfa965bd394

  • SHA256

    71f14703c8be712142931be8329bf8bfefa3a6648e5dc66a1b78d9270e83b5d3

  • SHA512

    cdd88e1d2a4e6f380090be35478959debc45d42ebd44a1f668005fcc56497080f6f63c10f8a5ed163d0813185fb20db850c5a75edec2729ba97973bcaebd8efa

  • SSDEEP

    6144:xov6y99QHsi24juzSQPoHZqaJ4iCK3pG/9hq61+tjKdES41KY5dQKAvEvwS8:mfj4juzSzHZ98Vl1+t+dE2Y7QKAvSg

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      dd660708c5811aebefce5e821fdcdb70

    • Size

      348KB

    • MD5

      dd660708c5811aebefce5e821fdcdb70

    • SHA1

      e6b6e5ba172faf74dca302f49276bcfa965bd394

    • SHA256

      71f14703c8be712142931be8329bf8bfefa3a6648e5dc66a1b78d9270e83b5d3

    • SHA512

      cdd88e1d2a4e6f380090be35478959debc45d42ebd44a1f668005fcc56497080f6f63c10f8a5ed163d0813185fb20db850c5a75edec2729ba97973bcaebd8efa

    • SSDEEP

      6144:xov6y99QHsi24juzSQPoHZqaJ4iCK3pG/9hq61+tjKdES41KY5dQKAvEvwS8:mfj4juzSzHZ98Vl1+t+dE2Y7QKAvSg

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks