Overview
overview
10Static
static
10ArdamaxKey...KV.exe
windows7-x64
3ArdamaxKey...KV.exe
windows10-2004-x64
3ArdamaxKey...WM.dll
windows7-x64
3ArdamaxKey...WM.dll
windows10-2004-x64
3ArdamaxKey...WM.exe
windows7-x64
6ArdamaxKey...WM.exe
windows10-2004-x64
6ArdamaxKey...WM.dll
windows7-x64
3ArdamaxKey...WM.dll
windows10-2004-x64
3ArdamaxKey...WM.chm
windows7-x64
1ArdamaxKey...WM.chm
windows10-2004-x64
1ArdamaxKey...WM.exe
windows7-x64
6ArdamaxKey...WM.exe
windows10-2004-x64
6ArdamaxKey...s.html
windows7-x64
3ArdamaxKey...s.html
windows10-2004-x64
3ArdamaxKey...��.htm
windows7-x64
3ArdamaxKey...��.htm
windows10-2004-x64
3ArdamaxKey...��.url
windows7-x64
1ArdamaxKey...��.url
windows10-2004-x64
1ArdamaxKey...��.url
windows7-x64
1ArdamaxKey...��.url
windows10-2004-x64
1ArdamaxKey...��.url
windows7-x64
1ArdamaxKey...��.url
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-09-2024 07:54
Behavioral task
behavioral1
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/AKV.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/AKV.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.chm
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/qs.html
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/qs.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/必看说明.htm
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/必看说明.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/河源下载站.url
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/河源下载站.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/用firefox浏览器上网更安全.url
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/用firefox浏览器上网更安全.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/金山毒霸2007 无限升级版.url
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/金山毒霸2007 无限升级版.url
Resource
win10v2004-20240802-en
General
-
Target
ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/AKV.exe
-
Size
388KB
-
MD5
b4c0c55a0686ef791abd2b05afee3d0b
-
SHA1
601824878d80551330226b77213561bd1c23d99d
-
SHA256
5b004e23bda3ced1069ab80e88745bd4de2fd023fae24b0135c276d669e6471d
-
SHA512
bf785746f23f0c36f6852bf7069bc0760b040e78a53d5229f1b2e781afc6c3e5012fb9e13f7f4e1bf614728915b0d50ea7e452f061ccd0541811d86d4efcca72
-
SSDEEP
6144:+0q4wPzwerB7q57bEux7/5Lx5v5EWK/GVSNFhH:84la7qYutZx5G
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AKV.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3060 AKV.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3060 AKV.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger\ArdamaxKeylogger\Ardamax Keylogger\AKV.exe"C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger\ArdamaxKeylogger\Ardamax Keylogger\AKV.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3060