Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    28-11-2024 16:29

General

  • Target

    www.satnet.biz/Install.exe

  • Size

    818KB

  • MD5

    a2cee1e2af064e875734ab3afb6a660e

  • SHA1

    de51dccd8c72a51135db4c0ef1dfafc93eeac9d2

  • SHA256

    5f5198fc2d3e2896bacc006b79843ebc022bdaa704e4d0ea17531b99038376a6

  • SHA512

    9b733d4a3460143afbc96633f242c01d1f92d3d1ee3db76e859428bb7b8f1f635b5c616f4c6ea6321edd1aa60f34115f1b44190f89061e1c931aadcc8b5099c9

  • SSDEEP

    24576:hwL/dHL3Vhr00qczLg1tF7MceAWuTMq8U3OF7nkPmSEz/C+bsm9:hwxHL3VhA09ngzF7MdAJgnmmdzBr

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\www.satnet.biz\Install.exe
    "C:\Users\Admin\AppData\Local\Temp\www.satnet.biz\Install.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\SysWOW64\28463\JLCS.exe
      "C:\Windows\system32\28463\JLCS.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    457KB

    MD5

    46ccfd974518e5849738449034a05a17

    SHA1

    d391108816aed7ba8f7beb205ad7171c74eae6b2

    SHA256

    571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe

    SHA512

    773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a

  • C:\Windows\SysWOW64\28463\JLCS.001

    Filesize

    414B

    MD5

    bd0d040c89aa25d69ab36bcb22dc8961

    SHA1

    32537e888e4a63f4227b1521b88853482bde553a

    SHA256

    1a101ca4079a177bf248d14221af41a88dc9e2044863bd56302b9291b305000e

    SHA512

    583864c0766d095be952111c3a03842d941ab52add9f834864c84e42f24b0145e8e2e2b772e40b220d201664c65e0827a9a58d5ad026ac728bd42ad9c311cc53

  • C:\Windows\SysWOW64\28463\JLCS.006

    Filesize

    8KB

    MD5

    395bbef326fa5ad1216b23f5debf167b

    SHA1

    aa4a7334b5a693b3f0d6f47b568e0d13a593d782

    SHA256

    7c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1

    SHA512

    dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679

  • C:\Windows\SysWOW64\28463\JLCS.007

    Filesize

    5KB

    MD5

    1b5e72f0ebd49cf146f9ae68d792ffe5

    SHA1

    1e90a69c12b9a849fbbac0670296b07331c1cf87

    SHA256

    8f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e

    SHA512

    6364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc

  • \Users\Admin\AppData\Local\Temp\@62E8.tmp

    Filesize

    4KB

    MD5

    a55cbc0f0125b005ef369020b4c17806

    SHA1

    010af3e2e84b337e91f5e0c791b01e1d527211ce

    SHA256

    27cfe74936e4090aafbef07ee45725923f4b1243135e1e3a51e3385dbcd7b637

    SHA512

    88e5f7905c86d73bc5af028f20c8bf49f700307926c5b92814c245abe08e9c35841116d428ddbd7b957b47ccc8980684c12608b6818e4b6c1c8c0d27d54a07be

  • \Windows\SysWOW64\28463\JLCS.exe

    Filesize

    912KB

    MD5

    6768ba61744862704760b66ce8f8fdd4

    SHA1

    e86cbed8cf20c2a9c76219d0c434bc310ffb2392

    SHA256

    4cf4bf2b7d2bb4215e255e1f2b1238ad989f3c8a98ebfd5cb033bccf32fedaa0

    SHA512

    eadb56b633707724ef4f47f8b421b0f3b2afa5a9800fae030f81aefae483eed6b494da470278273f388c3ae346a33cbbfe742924d231dab1c9b42bbefaf95a61

  • memory/1508-15-0x0000000002A20000-0x0000000002B03000-memory.dmp

    Filesize

    908KB

  • memory/2836-17-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/2836-27-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB