Analysis
-
max time kernel
94s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2024 03:23
Static task
static1
Behavioral task
behavioral1
Sample
d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe
Resource
win10v2004-20240709-en
General
-
Target
d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe
-
Size
886KB
-
MD5
8e508541ecff247bb9723f4163450d0c
-
SHA1
30636a219b5e6bdaab7584fad1da0d4812c1fbe6
-
SHA256
d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168
-
SHA512
99931222f1a052e17f176535008eebb10cfe4da3a03699dabb5a9d311f9f9644aaceffcd6706fbf8780ed260586d6dabf1e50b0810f8051dc6bfc50a3fbfcaaa
-
SSDEEP
24576:86rTs85pFZueI+rpehK26zNOXtnSAVz0NNJ:8Cs85prRI+rpeY2eNOXxl0NNJ
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\28463\SAQB.exe family_ardamax -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ko1.exeko.exed70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exeko3.exeko2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation ko1.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation ko.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation ko3.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation ko2.exe -
Executes dropped EXE 5 IoCs
Processes:
ko3.exeko2.exeko1.exeko.exeSAQB.exepid process 2384 ko3.exe 2556 ko2.exe 2060 ko1.exe 3272 ko.exe 4612 SAQB.exe -
Loads dropped DLL 4 IoCs
Processes:
ko.exeSAQB.exepid process 3272 ko.exe 4612 SAQB.exe 4612 SAQB.exe 4612 SAQB.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SAQB.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAQB Agent = "C:\\Windows\\SysWOW64\\28463\\SAQB.exe" SAQB.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
ko.exeSAQB.exedescription ioc process File created C:\Windows\SysWOW64\28463\SAQB.exe ko.exe File created C:\Windows\SysWOW64\28463\AKV.exe ko.exe File opened for modification C:\Windows\SysWOW64\28463 SAQB.exe File created C:\Windows\SysWOW64\28463\SAQB.001 ko.exe File created C:\Windows\SysWOW64\28463\SAQB.006 ko.exe File created C:\Windows\SysWOW64\28463\SAQB.007 ko.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ko3.exeko2.exeko1.exeko.exeSAQB.exed70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ko3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ko2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ko1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ko.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SAQB.exedescription pid process Token: 33 4612 SAQB.exe Token: SeIncBasePriorityPrivilege 4612 SAQB.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
SAQB.exepid process 4612 SAQB.exe 4612 SAQB.exe 4612 SAQB.exe 4612 SAQB.exe 4612 SAQB.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exeko3.exeko2.exeko1.exeko.exedescription pid process target process PID 3112 wrote to memory of 2384 3112 d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe ko3.exe PID 3112 wrote to memory of 2384 3112 d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe ko3.exe PID 3112 wrote to memory of 2384 3112 d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe ko3.exe PID 2384 wrote to memory of 2556 2384 ko3.exe ko2.exe PID 2384 wrote to memory of 2556 2384 ko3.exe ko2.exe PID 2384 wrote to memory of 2556 2384 ko3.exe ko2.exe PID 2556 wrote to memory of 2060 2556 ko2.exe ko1.exe PID 2556 wrote to memory of 2060 2556 ko2.exe ko1.exe PID 2556 wrote to memory of 2060 2556 ko2.exe ko1.exe PID 2060 wrote to memory of 3272 2060 ko1.exe ko.exe PID 2060 wrote to memory of 3272 2060 ko1.exe ko.exe PID 2060 wrote to memory of 3272 2060 ko1.exe ko.exe PID 3272 wrote to memory of 4612 3272 ko.exe SAQB.exe PID 3272 wrote to memory of 4612 3272 ko.exe SAQB.exe PID 3272 wrote to memory of 4612 3272 ko.exe SAQB.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe"C:\Users\Admin\AppData\Local\Temp\d70981a07b9cb09a0ee1b300f2944cdf6c8ce3f0c048c702c9b319b1e9903168.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\ko3.exe"C:\ko3.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\ko2.exe"C:\ko2.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\ko1.exe"C:\ko1.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\ko.exe"C:\ko.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\28463\SAQB.exe"C:\Windows\system32\28463\SAQB.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5908f7f4b0cf93759447afca95cd84aa6
SHA1d1903a49b211bcb4a460904019ee7441420aa961
SHA2563e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23
SHA512958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d
-
Filesize
393KB
MD5b0b09699ea39c0107af1c0833f07c054
SHA1b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1
SHA256be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1
SHA51255430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796
-
Filesize
406B
MD53589585abc6d566fd05be470bfac1804
SHA135d67e1acea7776243c40a3c733665b812f020d1
SHA256b04b82b1d1b39fc54c07a48fb8ebcfa52dc8c4f141ac368f5dad29c9688e6011
SHA5128abe65bbce0b1f7a0154d3a4dec647083fd2271f9a01323e3ec7b7b1e8f3f7e3f2d51ba9a4c53619d8bbf8eb06972bee00942a0cc9d5be2dc355b6c50d608613
-
Filesize
7KB
MD5e0fcfa7cad88d1a8a462cee6b06cf668
SHA1a7e49078517abc929a6da261df06556c8f5a8cf0
SHA256340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4
SHA512430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82
-
Filesize
5KB
MD5ca72cd485d116033f1b776903ce7ee0a
SHA185b0b73a75b0498f56200dd1a5cf0de5371e42a3
SHA256e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4
SHA5128dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f
-
Filesize
472KB
MD5d7bd4739313a8e2fc9e080b7d0ba13b2
SHA1808fcbe663bc02780b1d9962873a1e3066d55f05
SHA256c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b
SHA512d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398
-
Filesize
478KB
MD5d90810f314bfd521a2efefc11936c0c2
SHA1dc7aae03013b2cead6e1e1113dce87e5c48d792a
SHA256395d117e2821e702b6d30ffcea59dabc71053a011796d610244b27304e580e33
SHA512a1242594f5b4e379a1c1fba82a1c0855e6a9a68c7c1565b009c587cbf8bff1758e90f68707da2c9eef91371e1d649bb306d211ce0b2855c22c27cf32b6580029
-
Filesize
664KB
MD5780057e0802c7a29926c240f4e8e1dc9
SHA10c9eb2fd1206c9e92881852b0f96e6535fab2040
SHA2564cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631
SHA512ad9a92d5655be686c44584fa80aaf3b75c49a5021c4bedbfa279dbd62e54f5725e757b4f2ec2a875ccbb3dd06565f897c2404adbf8fb53cfa98334a399c90cf1
-
Filesize
738KB
MD54d4870a6642592b363c884ad6e3fa3c6
SHA17fdc6772670cd39254494d90aa729ddb368fd7b8
SHA2560d54c2beedb53e70205138aceb3a73eee295952fdaab01c7665b7651aba9a406
SHA512b92f1e6dff2848d01c667eae85c8c4a7b5578f68a90c0c5c3563bbcce8e954611dc2f6a000e76b6687496fdfc20ebfb0c8d2b5f764f0916121c27f1f9ac5a9c7
-
Filesize
812KB
MD51fed04ad8e3b3b0a790e3b32c518791a
SHA1bbb888a766983a23a09fd30aa4c346a8d070a38d
SHA2560b1f54811f672911028698ce2a4ebaf272022d599d5c283fe231fddc99252711
SHA51219b30de9e57887af1d8a73c418a389d06837cfcd0bdb6baab28c51b5c0c82778130574a880fc42acecd7e91690f56bea19087b01eddb5c580d6ad5e1c1d7e88a