Analysis

  • max time kernel
    131s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 07:55

General

  • Target

    ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe

  • Size

    783KB

  • MD5

    e33af9e602cbb7ac3634c2608150dd18

  • SHA1

    8f6ec9bc137822bc1ddf439c35fedc3b847ce3fe

  • SHA256

    8c870eec48bc4ea1aca1f0c63c8a82aaadaf837f197708a7f0321238da8b6b75

  • SHA512

    2ae5003e64b525049535ebd5c42a9d1f6d76052cccaa623026758aabe5b1d1b5781ca91c727f3ecb9ac30b829b8ce56f11b177f220330c704915b19b37f8f418

  • SSDEEP

    12288:0E9uQlDTt8c/wtocu3HhGSrIilDhlPnRq/iI7UOvqF8dtbcZl36VBqWPH:FuqD2cYWzBGZohlE/zUD8/bgl2qW/

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 29 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
    "C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\SysWOW64\28463\DPBJ.exe
      "C:\Windows\system32\28463\DPBJ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    457KB

    MD5

    97eee85d1aebf93d5d9400cb4e9c771b

    SHA1

    26fa2bf5fce2d86b891ac0741a6999bff31397de

    SHA256

    30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

    SHA512

    8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

  • C:\Windows\SysWOW64\28463\DPBJ.001

    Filesize

    492B

    MD5

    7a0f1fa20fd40c047b07379da5290f2b

    SHA1

    e0fb8305de6b661a747d849edb77d95959186fca

    SHA256

    b0ad9e9d3d51e8434cc466bec16e2b94fc2d03bab03b48ccf57db86ae8e2c9b6

    SHA512

    bb5b3138b863811a8b9dcba079ac8a2828dae73943a1cc1d107d27faca509fda9f03409db7c23d5d70b48d299146de14b656314a24b854f3ae4fdb6ef6770346

  • C:\Windows\SysWOW64\28463\DPBJ.009

    Filesize

    2.7MB

    MD5

    f95a61757e2a680ea5494cabb19f656c

    SHA1

    5f8d2f060579cc4656e90d8c5d6c82565d1b0c53

    SHA256

    61215bd550fc62b50afe7140d67c4f25c899138617d36caad3333f4914e73314

    SHA512

    13fdf5ab6839d456b3bedcb073ffacb7a79501c9bccbac09e8384d5fae46789839a3eaa81c502326e43352465db4121bf21f24d3157764ae2c1a61b48985e48c

  • C:\Windows\SysWOW64\28463\Nov_21_2024__07_59_51.jpg

    Filesize

    117KB

    MD5

    aa836bc743cb21e294c07a76a5b8933a

    SHA1

    b83f6114446d107d9b1524d23731f5f13c8bf0c1

    SHA256

    0cf5903fcc6f61cc5b7c9e198c0bec9eada389ee36081049a16e079f3497f7f5

    SHA512

    1e7452dbcfbeb8e2b7f38d36d365edceb4b68abcb27f4496a1f20741b17ba5a1a344dab553001ea6425a9bfc7e3eb1ec80e066f5f2aca74e804c0b6cb9644740

  • C:\Windows\SysWOW64\28463\key.bin

    Filesize

    106B

    MD5

    639d75ab6799987dff4f0cf79fa70c76

    SHA1

    be2678476d07f78bb81e8813c9ee2bfff7cc7efb

    SHA256

    fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

    SHA512

    4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

  • \Users\Admin\AppData\Local\Temp\@D172.tmp

    Filesize

    4KB

    MD5

    d73d89b1ea433724795b3d2b524f596c

    SHA1

    213514f48ece9f074266b122ee2d06e842871c8c

    SHA256

    8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

    SHA512

    8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

  • \Windows\SysWOW64\28463\DPBJ.006

    Filesize

    8KB

    MD5

    35b24c473bdcdb4411e326c6c437e8ed

    SHA1

    ec1055365bc2a66e52de2d66d24d742863c1ce3d

    SHA256

    4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

    SHA512

    32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

  • \Windows\SysWOW64\28463\DPBJ.007

    Filesize

    5KB

    MD5

    a8e19de6669e831956049685225058a8

    SHA1

    6d2546d49d92b18591ad4fedbc92626686e7e979

    SHA256

    34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

    SHA512

    5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

  • \Windows\SysWOW64\28463\DPBJ.exe

    Filesize

    646KB

    MD5

    b863a9ac3bcdcde2fd7408944d5bf976

    SHA1

    4bd106cd9aefdf2b51f91079760855e04f73f3b0

    SHA256

    0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

    SHA512

    4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

  • memory/2396-53-0x0000000000360000-0x00000000003BA000-memory.dmp

    Filesize

    360KB

  • memory/2396-34-0x00000000030B0000-0x00000000030B1000-memory.dmp

    Filesize

    4KB

  • memory/2396-47-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-46-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-45-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-44-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-43-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-42-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-49-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-50-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-51-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-52-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-59-0x0000000003110000-0x0000000003111000-memory.dmp

    Filesize

    4KB

  • memory/2396-58-0x00000000030D0000-0x00000000030D1000-memory.dmp

    Filesize

    4KB

  • memory/2396-57-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2396-56-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2396-55-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2396-54-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-38-0x00000000030B0000-0x00000000030B1000-memory.dmp

    Filesize

    4KB

  • memory/2396-41-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2396-19-0x0000000000360000-0x00000000003BA000-memory.dmp

    Filesize

    360KB

  • memory/2396-39-0x00000000030B0000-0x00000000030B3000-memory.dmp

    Filesize

    12KB

  • memory/2396-37-0x00000000030B0000-0x00000000030B1000-memory.dmp

    Filesize

    4KB

  • memory/2396-36-0x00000000030B0000-0x00000000030B1000-memory.dmp

    Filesize

    4KB

  • memory/2396-35-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-48-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-33-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-32-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-67-0x00000000030B0000-0x00000000030B1000-memory.dmp

    Filesize

    4KB

  • memory/2396-31-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-30-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-29-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-28-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-27-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-26-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2396-25-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

  • memory/2396-24-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/2396-23-0x0000000000570000-0x0000000000571000-memory.dmp

    Filesize

    4KB

  • memory/2396-22-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB

  • memory/2396-21-0x0000000000560000-0x0000000000561000-memory.dmp

    Filesize

    4KB

  • memory/2396-20-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2396-18-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2396-75-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2396-79-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2396-797-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2396-170-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2396-318-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2396-522-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2396-649-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2424-14-0x00000000029F0000-0x0000000002ACF000-memory.dmp

    Filesize

    892KB