Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 12:36

General

  • Target

    ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe

  • Size

    783KB

  • MD5

    e33af9e602cbb7ac3634c2608150dd18

  • SHA1

    8f6ec9bc137822bc1ddf439c35fedc3b847ce3fe

  • SHA256

    8c870eec48bc4ea1aca1f0c63c8a82aaadaf837f197708a7f0321238da8b6b75

  • SHA512

    2ae5003e64b525049535ebd5c42a9d1f6d76052cccaa623026758aabe5b1d1b5781ca91c727f3ecb9ac30b829b8ce56f11b177f220330c704915b19b37f8f418

  • SSDEEP

    12288:0E9uQlDTt8c/wtocu3HhGSrIilDhlPnRq/iI7UOvqF8dtbcZl36VBqWPH:FuqD2cYWzBGZohlE/zUD8/bgl2qW/

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
    "C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Windows\SysWOW64\28463\DPBJ.exe
      "C:\Windows\system32\28463\DPBJ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\@801D.tmp

    Filesize

    4KB

    MD5

    d73d89b1ea433724795b3d2b524f596c

    SHA1

    213514f48ece9f074266b122ee2d06e842871c8c

    SHA256

    8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

    SHA512

    8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    457KB

    MD5

    97eee85d1aebf93d5d9400cb4e9c771b

    SHA1

    26fa2bf5fce2d86b891ac0741a6999bff31397de

    SHA256

    30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

    SHA512

    8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

  • C:\Windows\SysWOW64\28463\DPBJ.001

    Filesize

    492B

    MD5

    7a0f1fa20fd40c047b07379da5290f2b

    SHA1

    e0fb8305de6b661a747d849edb77d95959186fca

    SHA256

    b0ad9e9d3d51e8434cc466bec16e2b94fc2d03bab03b48ccf57db86ae8e2c9b6

    SHA512

    bb5b3138b863811a8b9dcba079ac8a2828dae73943a1cc1d107d27faca509fda9f03409db7c23d5d70b48d299146de14b656314a24b854f3ae4fdb6ef6770346

  • C:\Windows\SysWOW64\28463\DPBJ.006

    Filesize

    8KB

    MD5

    35b24c473bdcdb4411e326c6c437e8ed

    SHA1

    ec1055365bc2a66e52de2d66d24d742863c1ce3d

    SHA256

    4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

    SHA512

    32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

  • C:\Windows\SysWOW64\28463\DPBJ.007

    Filesize

    5KB

    MD5

    a8e19de6669e831956049685225058a8

    SHA1

    6d2546d49d92b18591ad4fedbc92626686e7e979

    SHA256

    34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

    SHA512

    5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

  • C:\Windows\SysWOW64\28463\DPBJ.009

    Filesize

    1.5MB

    MD5

    a14027cc1bff3d79a6c7e09c42543dd6

    SHA1

    b3a7e1877cd0bad71a826777eac028735ab779ab

    SHA256

    ef60527d6c540663e2fde6b4b27086c264b6ee4d69a545393c1ea045504752e7

    SHA512

    7b7d58f9646cc3917f4c11d01ecb3a0a21207accc54f94412f0627f85d9806466febc334474facfae14d65fbe871c0f4fca519511045798e98d43e631b2aae13

  • C:\Windows\SysWOW64\28463\DPBJ.exe

    Filesize

    646KB

    MD5

    b863a9ac3bcdcde2fd7408944d5bf976

    SHA1

    4bd106cd9aefdf2b51f91079760855e04f73f3b0

    SHA256

    0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

    SHA512

    4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

  • C:\Windows\SysWOW64\28463\Nov_20_2024__12_39_35.jpg

    Filesize

    115KB

    MD5

    ec3af9f9e5c0a3d07595dcf1befe34f1

    SHA1

    41ca0e512a908373afcb95ba55185314f3dc6233

    SHA256

    42524c91f1dc3b7847d2e2b6ed624dbc1535e4836e98660d7ec31a92a2d25809

    SHA512

    98b1be41661a04dcf705aac6a8f7b30ae6a2c202eb256d6caaa31c6de7b9a7918e8c94e947ad1f2a1212c3958ddde3c54d380e814700abd9088a18c834c20585

  • C:\Windows\SysWOW64\28463\key.bin

    Filesize

    106B

    MD5

    639d75ab6799987dff4f0cf79fa70c76

    SHA1

    be2678476d07f78bb81e8813c9ee2bfff7cc7efb

    SHA256

    fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

    SHA512

    4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

  • memory/3512-32-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-51-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-26-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-31-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-29-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-28-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-33-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-34-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-36-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-37-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-38-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-35-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-39-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-42-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-41-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-40-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-44-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-47-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-46-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-48-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-49-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-45-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-50-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-27-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-52-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-54-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-53-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-55-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-57-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-58-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-56-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-43-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-30-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-64-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-25-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-65-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-24-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-21-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-72-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/3512-23-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-75-0x00007FFB947B0000-0x00007FFB949A5000-memory.dmp

    Filesize

    2.0MB

  • memory/3512-20-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/3512-164-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/3512-307-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/3512-509-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/3512-579-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/3512-777-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB