ardamax | a99e8aabcbe33fc2fda93ab6808c8f16c05a54bbedaf848182e27f4f65099bf8

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2024, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Size 1.1MB
Sample240718-1q1ehs1emc
SHA256 a99e8aabcbe33fc2fda93ab6808c8f16c05a54bbedaf848182e27f4f65099bf8
MD5 5937302c5d9b998e0d80f9476a8aa7b1
SHA1 5945ebfae25dd58abd8ed34d21a82ede4a14c866
SHA512 c042ac639a607d4eb52d0788f845defca9d5e9ce1df6672c7ef688ed0bee7d38b31948262c25181920e1ceaa91d1aa23b645ef7e6769b55e7b62d5b0cbc558d2
SSDEEP 24576:bPlDx29PP2l+zmtzRhOXYW64IhUVbhXl1GwmxWtE8yUpmdV/8YoCj3+A18:b9D49nmhGKhSV2HAE8yUQXEYf3b18
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax darkcomet discovery keylogger persistence rat stealer trojan

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.drivehq.com
Port
21
Username
umer93

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023460-31.dat	family_ardamax

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	INSTALL.EXE

Executes dropped EXE 2 IoCs

pid	Process
4996	INSTALL.EXE
3564	ARXX.exe

Loads dropped DLL 4 IoCs

pid	Process
4996	INSTALL.EXE
3564	ARXX.exe
3564	ARXX.exe
3564	ARXX.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ARXX Agent = "C:\\Windows\\SysWOW64\\28463\\ARXX.exe"	ARXX.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\28463	ARXX.exe
File created	C:\Windows\SysWOW64\28463\ARXX.009	ARXX.exe
File opened for modification	C:\Windows\SysWOW64\28463\ARXX.009	ARXX.exe
File created	C:\Windows\SysWOW64\28463\ARXX.001	INSTALL.EXE
File created	C:\Windows\SysWOW64\28463\ARXX.exe	INSTALL.EXE
File created	C:\Windows\SysWOW64\28463\AKV.exe	INSTALL.EXE
File created	C:\Windows\SysWOW64\28463\ARXX.006	INSTALL.EXE
File created	C:\Windows\SysWOW64\28463\ARXX.007	INSTALL.EXE
File created	C:\Windows\SysWOW64\28463\key.bin	INSTALL.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3084 set thread context of 3424	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\0\win32\ = "C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\VVIEWER.DLL"	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\0\win64	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\0\win64\	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\ProgID\ = "MSVidCtl.MSVidStreamBufferV2Source.1"	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\TypeLib\ = "{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}"	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\Version\ = "1.0"	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\VersionIndependentProgID\ = "MSVidCtl.MSVidStreamBufferV2Source"	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\InprocServer32\	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\InprocServer32	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\VersionIndependentProgID	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\ = "Iqaviqmik Iqaqigto Object"	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\0\win32\	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\FLAGS	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\FLAGS\	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\ProgID\	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\0	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\HELPDIR\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\"	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\TypeLib	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\Programmable\	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\Programmable	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\0\	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\0\win32	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\FLAGS\ = "0"	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\Version	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\VersionIndependentProgID\	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\TypeLib\	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSVidCtl.dll"	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\Implemented Categories\	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\ProgID	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\ = "Microsoft Visio Viewer 16.0 Type Library"	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\0\win64\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\VVIEWER.DLL"	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\HELPDIR	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDC1242B-1AF5-8EF7-D581-397D2F391A2A}\1.6\HELPDIR\	ARXX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\Version\	ARXX.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAA927E3-1F1D-490B-878C-EDC8123412AE}\Implemented Categories	ARXX.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3564	ARXX.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeSecurityPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeBackupPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeRestorePrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeShutdownPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeDebugPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeUndockPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: 33	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: 34	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: 35	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: 36	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3424	explorer.exe
Token: SeSecurityPrivilege	3424	explorer.exe
Token: SeTakeOwnershipPrivilege	3424	explorer.exe
Token: SeLoadDriverPrivilege	3424	explorer.exe
Token: SeSystemProfilePrivilege	3424	explorer.exe
Token: SeSystemtimePrivilege	3424	explorer.exe
Token: SeProfSingleProcessPrivilege	3424	explorer.exe
Token: SeIncBasePriorityPrivilege	3424	explorer.exe
Token: SeCreatePagefilePrivilege	3424	explorer.exe
Token: SeBackupPrivilege	3424	explorer.exe
Token: SeRestorePrivilege	3424	explorer.exe
Token: SeShutdownPrivilege	3424	explorer.exe
Token: SeDebugPrivilege	3424	explorer.exe
Token: SeSystemEnvironmentPrivilege	3424	explorer.exe
Token: SeChangeNotifyPrivilege	3424	explorer.exe
Token: SeRemoteShutdownPrivilege	3424	explorer.exe
Token: SeUndockPrivilege	3424	explorer.exe
Token: SeManageVolumePrivilege	3424	explorer.exe
Token: SeImpersonatePrivilege	3424	explorer.exe
Token: SeCreateGlobalPrivilege	3424	explorer.exe
Token: 33	3424	explorer.exe
Token: 34	3424	explorer.exe
Token: 35	3424	explorer.exe
Token: 36	3424	explorer.exe
Token: 33	3564	ARXX.exe
Token: SeIncBasePriorityPrivilege	3564	ARXX.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3564	ARXX.exe
3564	ARXX.exe
3564	ARXX.exe
3564	ARXX.exe
3564	ARXX.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 4996	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe	87
PID 3084 wrote to memory of 4996	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe	87
PID 3084 wrote to memory of 4996	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe	87
PID 3084 wrote to memory of 3424	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe	88
PID 3084 wrote to memory of 3424	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe	88
PID 3084 wrote to memory of 3424	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe	88
PID 3084 wrote to memory of 3424	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe	88
PID 3084 wrote to memory of 3424	3084	5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe	88
PID 4996 wrote to memory of 3564	4996	INSTALL.EXE	94
PID 4996 wrote to memory of 3564	4996	INSTALL.EXE	94
PID 4996 wrote to memory of 3564	4996	INSTALL.EXE	94

C:\Users\Admin\AppData\Local\Temp\5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5937302c5d9b998e0d80f9476a8aa7b1_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Local\Temp\INSTALL.EXE
  "C:\Users\Admin\AppData\Local\Temp\INSTALL.EXE"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\28463\ARXX.exe
    "C:\Windows\system32\28463\ARXX.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3564
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Checks BIOS information in registry
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@9C30.tmp

Path C:\Users\Admin\AppData\Local\Temp\@9C30.tmp
Size 4KB
SHA256 2ae6b0e14465338be0bc5ad10703f5c823d092ebb8cff7e5a05b7d79c8459b93
MD5 4b8ed89120fe8ddc31ddba07bc15372b
SHA1 181e7ac3d444656f50c1cd02a6832708253428e6
SHA512 49269b71270b3eda0ddcb399021de9c88f6fd2086cf54fa4898a91e64afe109d44b635d47a5ea9bae7f53a5e968af97fa13bdf699ba00ce879ecadd7bbc8af23
MD5 SHA1 SHA512

Submit Download

INSTALL.EXE

Path C:\Users\Admin\AppData\Local\Temp\INSTALL.EXE
Size 787KB
SHA256 81a1d995b2822b9e9fc7124c3c744e21dd2ea5a54deb2ea6b32ccccfcf432386
MD5 95b1cad3f097a7c7d0de6e70971a7e11
SHA1 4bc19b679a1916309f1a843b8bb3d78d40bd17ff
SHA512 016de4c2fb3922d5013f0daadf8779f54aa43168d9793cd055bc00ba164207f61b43b1383d05aba986a2e0031a0d2064d6614742759c5ab5c22ce4448db33f65
SSDEEP 24576:RSQ58oaGQQ/8s69XoOKDAW2/IgaYZOFHd+O+pDaL6h:RSQxQk8s6RoDApjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 457KB
SHA256 571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe
MD5 46ccfd974518e5849738449034a05a17
SHA1 d391108816aed7ba8f7beb205ad7171c74eae6b2
SHA512 773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a
SSDEEP 6144:y3CPF9R/a4bR55krSGKLFLtqWwxSnvAHc/0QR86ll8h/9VGC9HK:l/agR0rSGKBLtPMEvAHL2lr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ARXX.001

Path C:\Windows\SysWOW64\28463\ARXX.001
Size 376B
SHA256 5ae4bb2e5450b1cf60e861b17005e8686f98e5be19cd67293812c9b85a50b7cd
MD5 0552ee6fb8ed58e2bf8baf36929c1c8e
SHA1 1c89a3ecceba019c591768b1537ecb23a8ebd806
SHA512 bd257fe375242d9db82b41de1125caf32d6e7482d1ec0d037818fae328dc7617da08006133e9cf1e576a01021d75739d5367c30f066d648b9f315d32e2a04aa2
MD5 SHA1 SHA512

Submit Download

ARXX.006

Path C:\Windows\SysWOW64\28463\ARXX.006
Size 8KB
SHA256 7c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1
MD5 395bbef326fa5ad1216b23f5debf167b
SHA1 aa4a7334b5a693b3f0d6f47b568e0d13a593d782
SHA512 dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679
SSDEEP 192:IVdg5cxPjOhoZHOiX+/yWDpQzWXEM1DOcQs8O+y:Ik5cpOhSuK+/ynMEQfQ3O
MD5 SHA1 SHA512 SSDEEP

Submit Download

ARXX.007

Path C:\Windows\SysWOW64\28463\ARXX.007
Size 5KB
SHA256 8f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e
MD5 1b5e72f0ebd49cf146f9ae68d792ffe5
SHA1 1e90a69c12b9a849fbbac0670296b07331c1cf87
SHA512 6364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc
SSDEEP 48:6mn/3+o80EE/KD4XJQK5Gaayko1vmiXdjAECihnm8mMWrlo0P:6m0DMWaavoFRNsECi9mbrlo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ARXX.009

Path C:\Windows\SysWOW64\28463\ARXX.009
Size 1.5MB
SHA256 4a5f939d1a36654cdab1042d767201485c37b36c356abe3618c7f5db2880501c
MD5 a47f912c759102db2fa4dc1b7aac5732
SHA1 8db1fb19d95687577f794125347e0ff1099647a8
SHA512 678a974bde7612e8a2e6392f49c9244b78ea8e369acf99d4457129d555161af9035b11d9ba58e793a972c3b77c2aa99d41da3966989c6b8111b6449ac752ee3c
SSDEEP 24576:zFDGVXrHjFDGVXrH6FDGVXrHfFDGVXrHtFDGVXrHd:zFDGxnFDGxGFDGxDFDGxBFDGxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ARXX.exe

Path C:\Windows\SysWOW64\28463\ARXX.exe
Size 649KB
SHA256 2aa53bc5da3294817f95d8806effdf28e5af49661a955256c46db2b67cb6e6da
MD5 2bff0c75a04401dada0adfab933e46a7
SHA1 364d97f90b137f8e359d998164fb15d474be7bbb
SHA512 88b82973d3c042bceb75e12297111fa7b8bd4e2a7a37d26b698c595d8d75ec670cc7aebfa2572206c1b2a4ecbbfa3103affb8bee6d7ef47428a225e2cd1bea3f
SSDEEP 12288:z+/bmnuDF7LsmaIZumD5YBZq6xGJOpqtAnWGgAIb3NEnCztPvnK3STFiJ:zMYW/sma25Y+0Gkp0AWG1Imw83OFQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

key.bin

Path C:\Windows\SysWOW64\28463\key.bin
Size 108B
SHA256 1bc5f70204c2f77211b29cdb6ac3a994117f79819468fb596bf77f35074e9454
MD5 a25d1a1622ad706ee2d51565c1b7dab2
SHA1 5b41fd43e6225fd26c70cf8672119a41c230c442
SHA512 a97ea2620aa8bfea2d6788c88c2e4ff763b3115ed81a7b8202ccb4726c774eb294e659173906f65dec22f96a073275b3469eaea334c768d544cf94a7bfe50d80
MD5 SHA1 SHA512

Submit Download

memory/3084-21-0x0000000013140000-0x00000000132EE000-memory.dmp

Download

memory/3084-0-0x0000000013140000-0x00000000132EE000-memory.dmp

Download

memory/3084-1-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/3424-22-0x0000000013140000-0x00000000132EE000-memory.dmp

Download

memory/3424-23-0x0000000013140000-0x00000000132EE000-memory.dmp

Download

memory/3424-19-0x0000000000600000-0x0000000000A33000-memory.dmp

Download

memory/3424-18-0x0000000013140000-0x00000000132EE000-memory.dmp

Download

memory/3424-17-0x0000000013140000-0x00000000132EE000-memory.dmp

Download

memory/3564-39-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

memory/3564-58-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

memory/3564-89-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads