ardamax | 4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631

General

Target

4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631.exe
Size

664KB
MD5

780057e0802c7a29926c240f4e8e1dc9
SHA1

0c9eb2fd1206c9e92881852b0f96e6535fab2040
SHA256

4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631
SHA512

ad9a92d5655be686c44584fa80aaf3b75c49a5021c4bedbfa279dbd62e54f5725e757b4f2ec2a875ccbb3dd06565f897c2404adbf8fb53cfa98334a399c90cf1
SSDEEP

12288:xzy6rRxEn85p3vi4jDzXWgGVggDAiwBuztildkTwjP5bFJf0pxeyx007:86rTs85pa4jfhGz1iuzJwjP55Jf+xeu

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234a2-22.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	ko.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631.exe

Executes dropped EXE 2 IoCs

pid	Process
1428	ko.exe
3600	SAQB.exe

Loads dropped DLL 4 IoCs

pid	Process
1428	ko.exe
3600	SAQB.exe
3600	SAQB.exe
3600	SAQB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAQB Agent = "C:\\Windows\\SysWOW64\\28463\\SAQB.exe"	SAQB.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\SAQB.001	ko.exe
File created	C:\Windows\SysWOW64\28463\SAQB.006	ko.exe
File created	C:\Windows\SysWOW64\28463\SAQB.007	ko.exe
File created	C:\Windows\SysWOW64\28463\SAQB.exe	ko.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	ko.exe
File opened for modification	C:\Windows\SysWOW64\28463	SAQB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SAQB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3600	SAQB.exe
Token: SeIncBasePriorityPrivilege	3600	SAQB.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3600	SAQB.exe
3600	SAQB.exe
3600	SAQB.exe
3600	SAQB.exe
3600	SAQB.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 1428	3908	4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631.exe	85
PID 3908 wrote to memory of 1428	3908	4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631.exe	85
PID 3908 wrote to memory of 1428	3908	4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631.exe	85
PID 1428 wrote to memory of 3600	1428	ko.exe	87
PID 1428 wrote to memory of 3600	1428	ko.exe	87
PID 1428 wrote to memory of 3600	1428	ko.exe	87

C:\Users\Admin\AppData\Local\Temp\4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631.exe
"C:\Users\Admin\AppData\Local\Temp\4cde4b0bce630e9465a437f53cbbc7a960e752f82d31c7b9db2acc7b87a34631.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908
- C:\ko.exe
  "C:\ko.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\28463\SAQB.exe
    "C:\Windows\system32\28463\SAQB.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@A76B.tmp

Filesize
4KB

MD5
908f7f4b0cf93759447afca95cd84aa6

SHA1
d1903a49b211bcb4a460904019ee7441420aa961

SHA256
3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

SHA512
958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
393KB

MD5
b0b09699ea39c0107af1c0833f07c054

SHA1
b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1

SHA256
be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1

SHA512
55430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796

Download Submit
C:\Windows\SysWOW64\28463\SAQB.001

Filesize
406B

MD5
3589585abc6d566fd05be470bfac1804

SHA1
35d67e1acea7776243c40a3c733665b812f020d1

SHA256
b04b82b1d1b39fc54c07a48fb8ebcfa52dc8c4f141ac368f5dad29c9688e6011

SHA512
8abe65bbce0b1f7a0154d3a4dec647083fd2271f9a01323e3ec7b7b1e8f3f7e3f2d51ba9a4c53619d8bbf8eb06972bee00942a0cc9d5be2dc355b6c50d608613

Download Submit
C:\Windows\SysWOW64\28463\SAQB.006

Filesize
7KB

MD5
e0fcfa7cad88d1a8a462cee6b06cf668

SHA1
a7e49078517abc929a6da261df06556c8f5a8cf0

SHA256
340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

SHA512
430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

Download Submit
C:\Windows\SysWOW64\28463\SAQB.007

Filesize
5KB

MD5
ca72cd485d116033f1b776903ce7ee0a

SHA1
85b0b73a75b0498f56200dd1a5cf0de5371e42a3

SHA256
e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

SHA512
8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

Download Submit
C:\Windows\SysWOW64\28463\SAQB.exe

Filesize
472KB

MD5
d7bd4739313a8e2fc9e080b7d0ba13b2

SHA1
808fcbe663bc02780b1d9962873a1e3066d55f05

SHA256
c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b

SHA512
d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398

Download Submit
C:\ko.exe

Filesize
478KB

MD5
d90810f314bfd521a2efefc11936c0c2

SHA1
dc7aae03013b2cead6e1e1113dce87e5c48d792a

SHA256
395d117e2821e702b6d30ffcea59dabc71053a011796d610244b27304e580e33

SHA512
a1242594f5b4e379a1c1fba82a1c0855e6a9a68c7c1565b009c587cbf8bff1758e90f68707da2c9eef91371e1d649bb306d211ce0b2855c22c27cf32b6580029

Download Submit
memory/3600-34-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/3908-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads