Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 04:19

General

  • Target

    ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe

  • Size

    783KB

  • MD5

    e33af9e602cbb7ac3634c2608150dd18

  • SHA1

    8f6ec9bc137822bc1ddf439c35fedc3b847ce3fe

  • SHA256

    8c870eec48bc4ea1aca1f0c63c8a82aaadaf837f197708a7f0321238da8b6b75

  • SHA512

    2ae5003e64b525049535ebd5c42a9d1f6d76052cccaa623026758aabe5b1d1b5781ca91c727f3ecb9ac30b829b8ce56f11b177f220330c704915b19b37f8f418

  • SSDEEP

    12288:0E9uQlDTt8c/wtocu3HhGSrIilDhlPnRq/iI7UOvqF8dtbcZl36VBqWPH:FuqD2cYWzBGZohlE/zUD8/bgl2qW/

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
    "C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\SysWOW64\28463\DPBJ.exe
      "C:\Windows\system32\28463\DPBJ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    457KB

    MD5

    97eee85d1aebf93d5d9400cb4e9c771b

    SHA1

    26fa2bf5fce2d86b891ac0741a6999bff31397de

    SHA256

    30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

    SHA512

    8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

  • C:\Windows\SysWOW64\28463\DPBJ.001

    Filesize

    492B

    MD5

    7a0f1fa20fd40c047b07379da5290f2b

    SHA1

    e0fb8305de6b661a747d849edb77d95959186fca

    SHA256

    b0ad9e9d3d51e8434cc466bec16e2b94fc2d03bab03b48ccf57db86ae8e2c9b6

    SHA512

    bb5b3138b863811a8b9dcba079ac8a2828dae73943a1cc1d107d27faca509fda9f03409db7c23d5d70b48d299146de14b656314a24b854f3ae4fdb6ef6770346

  • C:\Windows\SysWOW64\28463\DPBJ.006

    Filesize

    8KB

    MD5

    35b24c473bdcdb4411e326c6c437e8ed

    SHA1

    ec1055365bc2a66e52de2d66d24d742863c1ce3d

    SHA256

    4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

    SHA512

    32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

  • C:\Windows\SysWOW64\28463\DPBJ.007

    Filesize

    5KB

    MD5

    a8e19de6669e831956049685225058a8

    SHA1

    6d2546d49d92b18591ad4fedbc92626686e7e979

    SHA256

    34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

    SHA512

    5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

  • C:\Windows\SysWOW64\28463\DPBJ.009

    Filesize

    1.3MB

    MD5

    733d1db2213c30f9331440d49436d7fa

    SHA1

    8e4e046c7794a7623e4125578494c07ce45a4bfb

    SHA256

    3a5da1fd9eead0284a84dabe95b6756aba57767704e4d4e1f53744f001d9cc1f

    SHA512

    ea03324214e457736988fab56825f280f027272905a7f3c06039c4f85c834f870605f74cd5b35076ab6576a55ad2f93a7a53ac722ec01f8928b18daa989cc80d

  • C:\Windows\SysWOW64\28463\Nov_20_2024__04_20_51.jpg

    Filesize

    98KB

    MD5

    a2276862a6adcff5bbf68880ed4cf5dd

    SHA1

    8b1923895fa318b5e8a94e0ce34349a1789aff2b

    SHA256

    3048d72cbf9292a2278021273c751fd8ad836ea4d93c7f54b06ff98ab4eee159

    SHA512

    55b1a8fec94dd2712165c24fa328a3b328e25ce7baa0fa529690364019228b502af93973e0e82b6eacddf7251cff7645aff2544630208f62bddb2a0862a7a561

  • C:\Windows\SysWOW64\28463\key.bin

    Filesize

    106B

    MD5

    639d75ab6799987dff4f0cf79fa70c76

    SHA1

    be2678476d07f78bb81e8813c9ee2bfff7cc7efb

    SHA256

    fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

    SHA512

    4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

  • \Users\Admin\AppData\Local\Temp\@311E.tmp

    Filesize

    4KB

    MD5

    d73d89b1ea433724795b3d2b524f596c

    SHA1

    213514f48ece9f074266b122ee2d06e842871c8c

    SHA256

    8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

    SHA512

    8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

  • \Windows\SysWOW64\28463\DPBJ.exe

    Filesize

    646KB

    MD5

    b863a9ac3bcdcde2fd7408944d5bf976

    SHA1

    4bd106cd9aefdf2b51f91079760855e04f73f3b0

    SHA256

    0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

    SHA512

    4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

  • memory/2832-30-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2832-26-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2832-22-0x0000000001F90000-0x0000000001F91000-memory.dmp

    Filesize

    4KB

  • memory/2832-21-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

    Filesize

    4KB

  • memory/2832-20-0x0000000000630000-0x0000000000631000-memory.dmp

    Filesize

    4KB

  • memory/2832-29-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2832-31-0x00000000030D0000-0x00000000030D1000-memory.dmp

    Filesize

    4KB

  • memory/2832-24-0x0000000001F70000-0x0000000001F71000-memory.dmp

    Filesize

    4KB

  • memory/2832-33-0x0000000003110000-0x0000000003111000-memory.dmp

    Filesize

    4KB

  • memory/2832-32-0x00000000005F0000-0x00000000005F1000-memory.dmp

    Filesize

    4KB

  • memory/2832-25-0x0000000000610000-0x0000000000611000-memory.dmp

    Filesize

    4KB

  • memory/2832-23-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

    Filesize

    4KB

  • memory/2832-27-0x00000000030B0000-0x00000000030B3000-memory.dmp

    Filesize

    12KB

  • memory/2832-28-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2832-44-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2832-47-0x00000000003A0000-0x00000000003FA000-memory.dmp

    Filesize

    360KB

  • memory/2832-18-0x00000000003A0000-0x00000000003FA000-memory.dmp

    Filesize

    360KB

  • memory/2832-49-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2832-17-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2832-138-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2832-279-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2832-336-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2832-485-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2832-606-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB