Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08-09-2024 18:14
General
-
Target
Installacijabre.exe
-
Size
1.1MB
-
MD5
f4dfb964bf2891ef0a4f757325a853d4
-
SHA1
8eb5496526e36f8785c7d05c975e35b422e9c0db
-
SHA256
db7d26cd5f1a0d872a7a29f93f5d52453f46e18c017fff115279ab3a17bb1e31
-
SHA512
b67c64a4bd4c643aa16f1584039f73ad7ee22f463baf9026ab98952f98448df2a71e41036e47fa2b182645e03e4ec6bfe32f94a12c4beb1ef1c13f71f3855610
-
SSDEEP
24576:2k/ATlOAQkx/6E0lcWLiw4vZzejEfRKMevdbYPT+DBY4csoa7Da:noTEAQk5I+z9devlYPT+dY4cso
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installacijabre.exe"C:\Users\Admin\AppData\Local\Temp\Installacijabre.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MHEPVG\OBI.exe"C:\Windows\system32\MHEPVG\OBI.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
466KB
MD54c5711d8a02899113661bdff195d80d5
SHA1263592abea6d60887defb4b1bcb47dbb383edfb6
SHA256661eee852ace18c0fe63548e3ca276866b40dd0dce722f67976b8c4bfdb92195
SHA5124b16ee6c75a169ad02c6b30d08efcd969ba8840adf49f6eeec3abbe8b9f5f288e1b1cfb4431711a74510a6973663335e43d256ae0dcd1a68f55331152a4f64ae
-
Filesize
61KB
MD57a5612cc859be918c5767487f8a6815a
SHA1a855d3a3e6336ac0508a8099e8ace14680394c36
SHA256643419bc7e3a46ecdd7196858b3489c806c5edc486b513ce58519a109544c9d1
SHA51231c541870dbc695c34d132c4232accc2fe511f30188a4db33d5c41758cf5af00a4906b55b0a208b5848436313fd3d8ccf6be7f1af62ecedd3a5c4c301dc5e11d
-
Filesize
43KB
MD5b2bcd668abf17ee408d232cc636614b2
SHA1c354f941121515536c4f0d9ae49ed1a9b28534b4
SHA256563f5e99f0beb961ecf6a8284bf41fee3e85d6f63cdff1669438f5a2168bfd99
SHA512ba1be164de5919ae45f4bedfebe7e7799626b457f07b42fc43b8912f2932955833617b45e147e2e4d406f57f57f50c1869aa611db18a569919395e42fa53a702
-
Filesize
1KB
MD556e6829a36214445fe06aaebcf12a313
SHA130113da39f855286bb07efebae882a5567041871
SHA25607fa00d78414cf186f764f6286c9ef81e8ef9c731d63c0fa560c9f146a22e99b
SHA51240c417e779c095f1795b624fcf5ebf22db58d924afbf5ac4fe8de7a245df63887f57a3e3ee9277e5af78f87f2efb23d1e9efdb60e38c4cc2306b7ff3c1935751
-
Filesize
1.5MB
MD5a9ea3f61a57b36cde9953afd91f18d34
SHA1e7e931b96b6e39b64a2a38d704bbe9561a234cbc
SHA256accbdc6de9b6b671e6dc5bda9f1f983fbfcaa07467fbf6eabd25b9d5314d82ec
SHA5120a6a42a772a3afd66233d9d3abb962b3a8cbf3d6e0e719352795b6441a148617dbe788991f0cead29d4b1540726504c9c56bebd9836ae6263b82a121fafd89fc
-
Filesize
4KB
-
Filesize
4KB