Analysis
-
max time kernel
141s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 02:22
General
-
Target
Aura Kasih.3gp.exe
-
Size
1.6MB
-
MD5
58488c76e6d0fd22564e21404013b5a5
-
SHA1
99490d02a265fca0b0bc9e872ad97692b0d15180
-
SHA256
381b23777603322ccaf6a8bfe5454f35aa6c8aba83b2d4a10a0f8634edeba592
-
SHA512
81d74d9816be07cbc0d0e9b8429b112d53c79dd230764333cfdcb159d11475eb6f881c0862c6b76f3d8e379139f89c80343222f05e8ab990d3311a478ae58112
-
SSDEEP
24576:3jqLBz+pKrlmMDRA7ELOh8iy0XYUlG2oBmyNE9PoH4xnJGmxW4fP2PgcBH:3GBiLMFAA+5X/zs+oTMW4fPu
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 36 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 14 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aura Kasih.3gp.exe"C:\Users\Admin\AppData\Local\Temp\Aura Kasih.3gp.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\VLXX.exe"C:\Windows\system32\28463\VLXX.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Smu_Panas_Beredar (1).3gp"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b4 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5cb07753c45624238b4403480372be5db
SHA110af5bfbed599165d996470278f011728e866df7
SHA25663c3ed8cbe11314a2f2cd6ff50305bad98075be9e09d22e45b47af557a3388e7
SHA5122c72cca45ef924104c6892dd96f2e27a5d43bacc9f3eb0eeee24c871cc1bd1642d77734822d9d934f93a77c884fa1c682cf1ceddffe157a613978d9edd184312
-
Filesize
746KB
MD5ad31960a1842bb649b7734cb576dbbb9
SHA1385a4a78106fec539459edf87939f1e59709ab61
SHA2561cf0cae32ded2f55359fbb2a28a92bc65f5f31bc66a70e91afb1da16c6008bd8
SHA512e5a000d9397a0f011095529eef1650594e16a5fdefc046e3e305078e11089992ecb8a747da5aa4c1bc98dd7e8be21bb18c000e924f8ff44a682a4de5dae4ab27
-
Filesize
457KB
MD542e2202ac32edb39ccf9979515018d85
SHA1c1e07fbe2fa759e2775d4dcf7de23a66d2422a1a
SHA256367b4028baf3df4a5f77169bd64c9ef8fd7968a4d6c852ae3f81a726f4b37222
SHA512a97d9e968b1f63dedba74999aabe6fd150aae985c1143d29b183cc0d663a45252c57494c3457136c5e500050c6af6c819f9ba7070b7d62300ede2e9a7c792768
-
Filesize
412B
MD530480670dbede82c3e9fa67f4e642fec
SHA15d46c5eb221c7dbcd14a650f77a5107e39534ee8
SHA256b868b691ac97168080c24afbbeec5acf31f0c51c1a11277dccb34d86c24d85b1
SHA512ae9383687e9094c4f0dede8c9cee134666cf7c85b881eb705087caa1dfb18be39ddcaa96129b7e1d521008f470a9cfe59dfa6135880ed39712c88a427064474d
-
Filesize
8KB
MD53da3041787b72a7909d9f6184ce6bc5e
SHA1fc7f00b8a1341b5341e2ba6f94ba85364bc90843
SHA25618e06896cc71e99b717cff8d68cba86fea3eba5087b93734f6418e53cadab5b3
SHA512150fa3f8eeec3621ac61eab0da3f2692dd776887ec0c1791404df3dd8784982563496e1e990217a99c4fd53c5d5d68e0574737879b72d78ab737033f1b08560a
-
Filesize
5KB
MD550d0bcf6b5a6b11d9e274ccefba3f02e
SHA157acf2a1236b7534f2db661a9d95aeadcd41aa2a
SHA256a5e5cf8b3133031f25db37fd13b029cdfc9d1588ca7f68041e52349f46cbbf5c
SHA512c0288f92c75f4a6ea45434e3960a3c5d8ed3d890121a3fd6da2449e1313db523224e301451d85a15ea8ee9b5c2fb3bf294ee90869a4d5608bcf48fa94458e938
-
Filesize
647KB
MD5a7b322839cedf8d56cb0a7dcdb50ab59
SHA1d27855e65f5d9e87666f39d2af694a0d75330a75
SHA256ba7362315c0608c9203c9d607fd85695fbc15f034ea40b3de7dd1abebd5859a3
SHA51286a416ae639ca458e56093d5c04f3406ac0389cf9a1047f714424ba89ffd047ca58e6927bc941d285d4db9e8a95e91e0d578be3038a83945b6af90586ea9f649
-
Filesize
105B
MD527c90d4d9b049f4cd00f32ed1d2e5baf
SHA1338a3ea8f1e929d8916ece9b6e91e697eb562550
SHA256172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb
SHA512d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
116KB
-
Filesize
2.0MB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
132KB
-
Filesize
260KB
-
Filesize
16.7MB
-
Filesize
2.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
992KB
-
Filesize
2.7MB