ardamax | a7ab128bb5a87746b9d62bc972c3a7a80a480958296f961334a56bfd365ff022

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

installation.exe
Size

3.6MB
MD5

a1ac30d527ca424d85d24ff7438bdd86
SHA1

eda30795603064026eaf0c66ca07c57f11175f95
SHA256

db04a74f37a30b4ec12c44de76ef66c757172d2295a1137ebc322bd5149edb23
SHA512

f9434464e23f6a8d28f952b62ec8022779700f137b5ba8d316c620deb26e9dfca012fcc79e926e5cfddb23080be4531c9a59abe687258e9e673f4afe07450570
SSDEEP

98304:i0Npnl8aYKP2iajaXMiIWiUMkoktBg6woiP:i6DYKP2vuXMiLiUTI6I

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233a1-40.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	installation.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	ardamax.exe

Executes dropped EXE 4 IoCs

pid	Process
2304	ardamax.exe
3528	Proxy Switcher PRO v3.9.0.4059.exe
2728	FLFU.exe
1300	is-89GNL.tmp

Loads dropped DLL 7 IoCs

pid	Process
2304	ardamax.exe
2728	FLFU.exe
2728	FLFU.exe
2728	FLFU.exe
1300	is-89GNL.tmp
1300	is-89GNL.tmp
1300	is-89GNL.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FLFU Agent = "C:\\Windows\\SysWOW64\\28463\\FLFU.exe"	FLFU.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\FLFU.001	ardamax.exe
File created	C:\Windows\SysWOW64\28463\FLFU.006	ardamax.exe
File created	C:\Windows\SysWOW64\28463\FLFU.007	ardamax.exe
File created	C:\Windows\SysWOW64\28463\FLFU.exe	ardamax.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	ardamax.exe
File opened for modification	C:\Windows\SysWOW64\28463	FLFU.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2180 set thread context of 2920	2180	installation.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ardamax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Proxy Switcher PRO v3.9.0.4059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FLFU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-89GNL.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installation.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2180	installation.exe
2180	installation.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2728	FLFU.exe
Token: SeIncBasePriorityPrivilege	2728	FLFU.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2728	FLFU.exe
2728	FLFU.exe
2728	FLFU.exe
2728	FLFU.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2180 wrote to memory of 2920	2180	installation.exe	82
PID 2920 wrote to memory of 2304	2920	installation.exe	83
PID 2920 wrote to memory of 2304	2920	installation.exe	83
PID 2920 wrote to memory of 2304	2920	installation.exe	83
PID 2920 wrote to memory of 3528	2920	installation.exe	84
PID 2920 wrote to memory of 3528	2920	installation.exe	84
PID 2920 wrote to memory of 3528	2920	installation.exe	84
PID 2304 wrote to memory of 2728	2304	ardamax.exe	85
PID 2304 wrote to memory of 2728	2304	ardamax.exe	85
PID 2304 wrote to memory of 2728	2304	ardamax.exe	85
PID 3528 wrote to memory of 1300	3528	Proxy Switcher PRO v3.9.0.4059.exe	86
PID 3528 wrote to memory of 1300	3528	Proxy Switcher PRO v3.9.0.4059.exe	86
PID 3528 wrote to memory of 1300	3528	Proxy Switcher PRO v3.9.0.4059.exe	86

C:\Users\Admin\AppData\Local\Temp\installation.exe
"C:\Users\Admin\AppData\Local\Temp\installation.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\installation.exe
  C:\Users\Admin\AppData\Local\Temp\installation.exe
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\ardamax.exe
    "C:\Users\Admin\AppData\Local\Temp\ardamax.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\SysWOW64\28463\FLFU.exe
      "C:\Windows\system32\28463\FLFU.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Proxy Switcher PRO v3.9.0.4059.exe
    "C:\Users\Admin\AppData\Local\Temp\Proxy Switcher PRO v3.9.0.4059.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\is-P5HN9.tmp\is-89GNL.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-P5HN9.tmp\is-89GNL.tmp" /SL4 $A0114 "C:\Users\Admin\AppData\Local\Temp\Proxy Switcher PRO v3.9.0.4059.exe" 3014795 51200
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@67F1.tmp

Filesize
4KB

MD5
c3679c3ff636d1a6b8c65323540da371

SHA1
d184758721a426467b687bec2a4acc80fe44c6f8

SHA256
d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb

SHA512
494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Proxy Switcher PRO v3.9.0.4059.exe

Filesize
3.1MB

MD5
743ffe7093911a1dc10010ea4b703fc4

SHA1
75debe237e611d093b37cb33188f72726b5d41fe

SHA256
cf7d56c3dd612b84113ae3d2f67c68d6b9bb0c40990b6737933ed22922d4c531

SHA512
6563d652d8b30c541a623dd70255006ba09b55596c205b48791ed3fc2d85bb3e4187edd77a4f7962a97bdbf29c4ee8926e9381d4a87818cd11934747c5e0aeb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ardamax.exe

Filesize
480KB

MD5
649310bf5be8900e493f558882c141ef

SHA1
adb0039ceaae0f712ba85cea6c4f397c1e7cc49c

SHA256
5b71f9a823043f5025a4163d7e4b3514f65f88cfe0b963c757de5073514dc57a

SHA512
b2c38f37e6d5a3cea1046dcb3742f566a58475d5acf94f534015a189c7eccd94390f4ac202f9e629b61950edd9f594995aec46359a20430a7c45794d70e70cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P5HN9.tmp\is-89GNL.tmp

Filesize
615KB

MD5
667555fc8d80c030ed5de256404df5c5

SHA1
44a4ea8240378905cf40527b0bd9da7ffb22416f

SHA256
74ef33e3b3298d8ca7166c2b07a490a74c5a9a26b08b9478a524096208d5600a

SHA512
88aee726e41cf4e2635deaea68a374a8eda14e82bc65babb566ec60a93fcea823bde67f9d47e69af946b3d1c8c9fb2ea9003fe83b5c401384c64977dfebcc998

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
395KB

MD5
b8fa30233794772b8b76b4b1d91c7321

SHA1
0cf9561be2528944285e536f41d502be24c3aa87

SHA256
14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a

SHA512
10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d

Download Submit
C:\Windows\SysWOW64\28463\FLFU.001

Filesize
420B

MD5
1f637a6ea0498c817c54ced6db9309b0

SHA1
00ea97dd706511a0e73aa94251b9b62c99ae0fb2

SHA256
a546a211b8aa6d61bcba6c4e79856761268ac9c910cd7ab2069d65c2af8234af

SHA512
98d24ec0abce200ca31d0b5850659b8899b730f58879768841a9c9e787fd6a6b0d8f15047c2009a07ebc7b17255b17f4cd7ba3b9d897e3c86337d69337a7d855

Download Submit
C:\Windows\SysWOW64\28463\FLFU.006

Filesize
8KB

MD5
43f02e9974b1477c1e6388882f233db0

SHA1
f3e27b231193f8d5b2e1b09d05ae3a62795cf339

SHA256
3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba

SHA512
e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

Download Submit
C:\Windows\SysWOW64\28463\FLFU.007

Filesize
5KB

MD5
b5a87d630436f958c6e1d82d15f98f96

SHA1
d3ff5e92198d4df0f98a918071aca53550bf1cff

SHA256
a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2

SHA512
fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

Download Submit
C:\Windows\SysWOW64\28463\FLFU.exe

Filesize
473KB

MD5
17535dddecf8cb1efdba1f1952126547

SHA1
a862a9a3eb6c201751be1038537522a5281ea6cb

SHA256
1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd

SHA512
b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

Download Submit
memory/1300-75-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-83-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-91-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-89-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-87-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-85-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-81-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-65-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-67-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-69-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-71-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-73-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-79-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1300-77-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2920-0-0x0000000000400000-0x000000000079D000-memory.dmp

Filesize
3.6MB

Download
memory/2920-31-0x0000000000400000-0x000000000079D000-memory.dmp

Filesize
3.6MB

Download
memory/2920-2-0x0000000000400000-0x000000000079D000-memory.dmp

Filesize
3.6MB

Download
memory/2920-3-0x0000000000400000-0x000000000079D000-memory.dmp

Filesize
3.6MB

Download
memory/3528-64-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3528-34-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3528-36-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download