ardamax | f804b40b0aa9a45cd51200b89d03ec0d9a89a4b4422df090fe8414e5c73cc1c0

Analysis

max time kernel
127s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]/Patch/ardamax.keylogger.4.0-patch.exe
Size 1.1MB
Sample240430-t97vdaba4z
SHA256 dd2b0a0ad91ec54c644acc338074f3b8a8cea431a2f8f9ec14b5beed65e1baa3
MD5 0e9bbf3419efd1d9be9a405f4f65ae5b
SHA1 30cf22bf6656a156ba4f399673382af58f31444e
SHA512 75dcb0b176f494e4e9e7d705152e34be6ab2f9826a1f3f7dcac95b7bf8c66e5d85173450968974fcb9cb02c1143e2c0908d4e117ad56a55e384304d9c10fec8c
SSDEEP 24576:u3sA36quTADSOsCQOxCzE/XpGhs9SqfQ0+IvMk0XFROXAfy67E:u8LtONx/5zUwQ0jgXbOyyt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral5/files/0x000b000000015605-1.dat	family_ardamax

Loads dropped DLL 1 IoCs

pid	Process
2392	ardamax.keylogger.4.0-patch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	ardamax.keylogger.4.0-patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a003100000000009e58d785102054656d700000360008000400efbe7d5733889e58d7852a000000ff010000000002000000000000000000000000000000540065006d007000000014000000	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c004346534616003100000000007d573388122041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe7d5733887d5733882a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000042000000	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	ardamax.keylogger.4.0-patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1"	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000009e58d7851020506174636800380008000400efbe9e58d7859e58d7852a000000ee5c010000000700000000000000000000000000000050006100740063006800000014000000	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = ae003100000000009e58d7851020415244414d417e312e494e5f0000920008000400efbe9e58d7859e58d7852a000000ce5c010000000800000000000000000000000000000041007200640061006d006100780020004b00650079006c006f006700670065007200200034002e00300020006200790020005b005b0050006c0075006e00640065007200740068006500730065006300750072006900740079002e0069006e005d005d0000001c000000	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	ardamax.keylogger.4.0-patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	ardamax.keylogger.4.0-patch.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	ardamax.keylogger.4.0-patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000007d57c48b10204c6f63616c00380008000400efbe7d5733887d57c48b2a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000	ardamax.keylogger.4.0-patch.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	ardamax.keylogger.4.0-patch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2392	ardamax.keylogger.4.0-patch.exe

C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]\Patch\ardamax.keylogger.4.0-patch.exe
"C:\Users\Admin\AppData\Local\Temp\Ardamax Keylogger 4.0 by [[Plunderthesecurity.in]]\Patch\ardamax.keylogger.4.0-patch.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dup2patcher.dll

Path \Users\Admin\AppData\Local\Temp\dup2patcher.dll
Size 991KB
SHA256 77efd84da70abb4a42d001aa1256ad3fe393644da2ad2dedbc3b45d3ec89d1b8
MD5 a4896f49d683030e854678305e7dff51
SHA1 dace9fddc2907c1a5828a66fb5aea0851d1c72c0
SHA512 8c0919973c1ad86bffa0b18cdd7288f818b6447a3fa15d96623c89aa19127c89e0e4bbcce40cfbaad03be5a634b2451ceb0df5cc7fcec20bf801e7a064febe65
SSDEEP 6144:H7gc2ldltF9jWWmG8Tddd2Hdddddddddddd1ddddddddddddddddddddddddeUdt:kc2ldltF9jWFWuEwm4v9UH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2392-3-0x0000000074800000-0x0000000074910000-memory.dmp

Download

memory/2392-5-0x0000000005600000-0x0000000005602000-memory.dmp