Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 04:19

General

  • Target

    ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe

  • Size

    783KB

  • MD5

    e33af9e602cbb7ac3634c2608150dd18

  • SHA1

    8f6ec9bc137822bc1ddf439c35fedc3b847ce3fe

  • SHA256

    8c870eec48bc4ea1aca1f0c63c8a82aaadaf837f197708a7f0321238da8b6b75

  • SHA512

    2ae5003e64b525049535ebd5c42a9d1f6d76052cccaa623026758aabe5b1d1b5781ca91c727f3ecb9ac30b829b8ce56f11b177f220330c704915b19b37f8f418

  • SSDEEP

    12288:0E9uQlDTt8c/wtocu3HhGSrIilDhlPnRq/iI7UOvqF8dtbcZl36VBqWPH:FuqD2cYWzBGZohlE/zUD8/bgl2qW/

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
    "C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Windows\SysWOW64\28463\DPBJ.exe
      "C:\Windows\system32\28463\DPBJ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\@6EA8.tmp

    Filesize

    4KB

    MD5

    d73d89b1ea433724795b3d2b524f596c

    SHA1

    213514f48ece9f074266b122ee2d06e842871c8c

    SHA256

    8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

    SHA512

    8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    457KB

    MD5

    97eee85d1aebf93d5d9400cb4e9c771b

    SHA1

    26fa2bf5fce2d86b891ac0741a6999bff31397de

    SHA256

    30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

    SHA512

    8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

  • C:\Windows\SysWOW64\28463\DPBJ.001

    Filesize

    492B

    MD5

    7a0f1fa20fd40c047b07379da5290f2b

    SHA1

    e0fb8305de6b661a747d849edb77d95959186fca

    SHA256

    b0ad9e9d3d51e8434cc466bec16e2b94fc2d03bab03b48ccf57db86ae8e2c9b6

    SHA512

    bb5b3138b863811a8b9dcba079ac8a2828dae73943a1cc1d107d27faca509fda9f03409db7c23d5d70b48d299146de14b656314a24b854f3ae4fdb6ef6770346

  • C:\Windows\SysWOW64\28463\DPBJ.006

    Filesize

    8KB

    MD5

    35b24c473bdcdb4411e326c6c437e8ed

    SHA1

    ec1055365bc2a66e52de2d66d24d742863c1ce3d

    SHA256

    4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

    SHA512

    32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

  • C:\Windows\SysWOW64\28463\DPBJ.007

    Filesize

    5KB

    MD5

    a8e19de6669e831956049685225058a8

    SHA1

    6d2546d49d92b18591ad4fedbc92626686e7e979

    SHA256

    34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

    SHA512

    5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

  • C:\Windows\SysWOW64\28463\DPBJ.009

    Filesize

    1.5MB

    MD5

    0706887384aaafbe26eb59b3ac5df534

    SHA1

    85fde1c22c7c2393e944139040cccbf2044ab8cd

    SHA256

    d7346280907669d7ce0da32a24b99da334702c44a2c6da4f5d55de72df769852

    SHA512

    fe7b418d16703ce398f5707ae897b2804f2da18c0b68ba1a0f9269258fb5c2ce0e2853ac7f6b7f6503a200c66ae0fe981674837e828e7e41a29084b949c6fca6

  • C:\Windows\SysWOW64\28463\DPBJ.exe

    Filesize

    646KB

    MD5

    b863a9ac3bcdcde2fd7408944d5bf976

    SHA1

    4bd106cd9aefdf2b51f91079760855e04f73f3b0

    SHA256

    0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

    SHA512

    4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

  • C:\Windows\SysWOW64\28463\Nov_20_2024__04_20_47.jpg

    Filesize

    114KB

    MD5

    f1e2344e74949a2f3c3f2ccf94c31961

    SHA1

    faf1b2ab6eb2e055ceaff1f5a89b547ab3506511

    SHA256

    e59c5fdd36972fac0de6dac06ba1ac77782faa1ec959a22458d7be3d596ad99f

    SHA512

    23baccf8c89722fbb83d8347a0d510b4c543e2d9475a4465797aa4a2402b377f695ac301f6c4b350b174c3f8e3352d5b970895ede742ff0fe970db4a2bf02452

  • C:\Windows\SysWOW64\28463\key.bin

    Filesize

    106B

    MD5

    639d75ab6799987dff4f0cf79fa70c76

    SHA1

    be2678476d07f78bb81e8813c9ee2bfff7cc7efb

    SHA256

    fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

    SHA512

    4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

  • memory/2228-39-0x0000000003270000-0x0000000003271000-memory.dmp

    Filesize

    4KB

  • memory/2228-32-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2228-29-0x0000000003220000-0x0000000003221000-memory.dmp

    Filesize

    4KB

  • memory/2228-28-0x0000000002390000-0x0000000002391000-memory.dmp

    Filesize

    4KB

  • memory/2228-27-0x00000000023D0000-0x00000000023D1000-memory.dmp

    Filesize

    4KB

  • memory/2228-26-0x0000000002410000-0x0000000002411000-memory.dmp

    Filesize

    4KB

  • memory/2228-25-0x00000000023F0000-0x00000000023F1000-memory.dmp

    Filesize

    4KB

  • memory/2228-24-0x0000000002400000-0x0000000002401000-memory.dmp

    Filesize

    4KB

  • memory/2228-23-0x00000000023B0000-0x00000000023B1000-memory.dmp

    Filesize

    4KB

  • memory/2228-31-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2228-38-0x0000000003230000-0x0000000003231000-memory.dmp

    Filesize

    4KB

  • memory/2228-36-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/2228-37-0x0000000000670000-0x0000000000671000-memory.dmp

    Filesize

    4KB

  • memory/2228-30-0x0000000003210000-0x0000000003213000-memory.dmp

    Filesize

    12KB

  • memory/2228-33-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2228-34-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2228-35-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2228-51-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2228-53-0x00000000021B0000-0x000000000220A000-memory.dmp

    Filesize

    360KB

  • memory/2228-21-0x00000000021B0000-0x000000000220A000-memory.dmp

    Filesize

    360KB

  • memory/2228-55-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2228-20-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2228-147-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2228-294-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2228-499-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2228-598-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2228-772-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB