ardamax | 4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631 | Triage

Sharing

General

Target

4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631
Size

664KB
Sample

240726-1h285swfjk
MD5

780057e0802c7a29926c240f4e8e1dc9
SHA1

0c9eb2fd1206c9e92881852b0f96e6535fab2040
SHA256

4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631
SHA512

ad9a92d5655be686c44584fa80aaf3b75c49a5021c4bedbfa279dbd62e54f5725e757b4f2ec2a875ccbb3dd06565f897c2404adbf8fb53cfa98334a399c90cf1
SSDEEP

12288:xzy6rRxEn85p3vi4jDzXWgGVggDAiwBuztildkTwjP5bFJf0pxeyx007:86rTs85pa4jfhGz1iuzJwjP55Jf+xeu

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Targets

- Target
  
  4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631
- Size
  
  664KB
- MD5
  
  780057e0802c7a29926c240f4e8e1dc9
- SHA1
  
  0c9eb2fd1206c9e92881852b0f96e6535fab2040
- SHA256
  
  4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631
- SHA512
  
  ad9a92d5655be686c44584fa80aaf3b75c49a5021c4bedbfa279dbd62e54f5725e757b4f2ec2a875ccbb3dd06565f897c2404adbf8fb53cfa98334a399c90cf1
- SSDEEP
  
  12288:xzy6rRxEn85p3vi4jDzXWgGVggDAiwBuztildkTwjP5bFJf0pxeyx007:86rTs85pa4jfhGz1iuzJwjP55Jf+xeu
Score

10^/10

ardamax discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerpersistencestealer