Overview
overview
10Static
static
3Softcam li...iz.htm
windows7-x64
3Softcam li...iz.htm
windows10-2004-x64
3www.satnet...ll.exe
windows7-x64
10www.satnet...ll.exe
windows10-2004-x64
10www.satnet...iz.htm
windows7-x64
3www.satnet...iz.htm
windows10-2004-x64
3www.satnet...TE.url
windows7-x64
6www.satnet...TE.url
windows10-2004-x64
3www.satnet...iz.htm
windows7-x64
3www.satnet...iz.htm
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28-11-2024 16:29
Static task
static1
Behavioral task
behavioral1
Sample
Softcam link www.satnet.biz.htm
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Softcam link www.satnet.biz.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
www.satnet.biz/Install.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
www.satnet.biz/Install.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
www.satnet.biz/Oktagon Softcam link www.satnet.biz.htm
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
www.satnet.biz/Oktagon Softcam link www.satnet.biz.htm
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
www.satnet.biz/SITE.url
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
www.satnet.biz/SITE.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
www.satnet.biz/www.satnet.biz.htm
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
www.satnet.biz/www.satnet.biz.htm
Resource
win10v2004-20241007-en
General
-
Target
www.satnet.biz/Install.exe
-
Size
818KB
-
MD5
a2cee1e2af064e875734ab3afb6a660e
-
SHA1
de51dccd8c72a51135db4c0ef1dfafc93eeac9d2
-
SHA256
5f5198fc2d3e2896bacc006b79843ebc022bdaa704e4d0ea17531b99038376a6
-
SHA512
9b733d4a3460143afbc96633f242c01d1f92d3d1ee3db76e859428bb7b8f1f635b5c616f4c6ea6321edd1aa60f34115f1b44190f89061e1c931aadcc8b5099c9
-
SSDEEP
24576:hwL/dHL3Vhr00qczLg1tF7MceAWuTMq8U3OF7nkPmSEz/C+bsm9:hwxHL3VhA09ngzF7MdAJgnmmdzBr
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral3/files/0x00050000000193d1-9.dat family_ardamax -
Executes dropped EXE 1 IoCs
pid Process 2836 JLCS.exe -
Loads dropped DLL 6 IoCs
pid Process 1508 Install.exe 1508 Install.exe 2836 JLCS.exe 2836 JLCS.exe 2836 JLCS.exe 2836 JLCS.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JLCS Agent = "C:\\Windows\\SysWOW64\\28463\\JLCS.exe" JLCS.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\28463 JLCS.exe File created C:\Windows\SysWOW64\28463\JLCS.001 Install.exe File created C:\Windows\SysWOW64\28463\JLCS.006 Install.exe File created C:\Windows\SysWOW64\28463\JLCS.007 Install.exe File created C:\Windows\SysWOW64\28463\JLCS.exe Install.exe File created C:\Windows\SysWOW64\28463\AKV.exe Install.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2836 JLCS.exe Token: SeIncBasePriorityPrivilege 2836 JLCS.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2836 JLCS.exe 2836 JLCS.exe 2836 JLCS.exe 2836 JLCS.exe 2836 JLCS.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2836 1508 Install.exe 30 PID 1508 wrote to memory of 2836 1508 Install.exe 30 PID 1508 wrote to memory of 2836 1508 Install.exe 30 PID 1508 wrote to memory of 2836 1508 Install.exe 30 PID 1508 wrote to memory of 2836 1508 Install.exe 30 PID 1508 wrote to memory of 2836 1508 Install.exe 30 PID 1508 wrote to memory of 2836 1508 Install.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\www.satnet.biz\Install.exe"C:\Users\Admin\AppData\Local\Temp\www.satnet.biz\Install.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\28463\JLCS.exe"C:\Windows\system32\28463\JLCS.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457KB
MD546ccfd974518e5849738449034a05a17
SHA1d391108816aed7ba8f7beb205ad7171c74eae6b2
SHA256571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe
SHA512773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a
-
Filesize
414B
MD5bd0d040c89aa25d69ab36bcb22dc8961
SHA132537e888e4a63f4227b1521b88853482bde553a
SHA2561a101ca4079a177bf248d14221af41a88dc9e2044863bd56302b9291b305000e
SHA512583864c0766d095be952111c3a03842d941ab52add9f834864c84e42f24b0145e8e2e2b772e40b220d201664c65e0827a9a58d5ad026ac728bd42ad9c311cc53
-
Filesize
8KB
MD5395bbef326fa5ad1216b23f5debf167b
SHA1aa4a7334b5a693b3f0d6f47b568e0d13a593d782
SHA2567c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1
SHA512dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679
-
Filesize
5KB
MD51b5e72f0ebd49cf146f9ae68d792ffe5
SHA11e90a69c12b9a849fbbac0670296b07331c1cf87
SHA2568f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e
SHA5126364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc
-
Filesize
4KB
MD5a55cbc0f0125b005ef369020b4c17806
SHA1010af3e2e84b337e91f5e0c791b01e1d527211ce
SHA25627cfe74936e4090aafbef07ee45725923f4b1243135e1e3a51e3385dbcd7b637
SHA51288e5f7905c86d73bc5af028f20c8bf49f700307926c5b92814c245abe08e9c35841116d428ddbd7b957b47ccc8980684c12608b6818e4b6c1c8c0d27d54a07be
-
Filesize
912KB
MD56768ba61744862704760b66ce8f8fdd4
SHA1e86cbed8cf20c2a9c76219d0c434bc310ffb2392
SHA2564cf4bf2b7d2bb4215e255e1f2b1238ad989f3c8a98ebfd5cb033bccf32fedaa0
SHA512eadb56b633707724ef4f47f8b421b0f3b2afa5a9800fae030f81aefae483eed6b494da470278273f388c3ae346a33cbbfe742924d231dab1c9b42bbefaf95a61