ardamax | 89dbec9a3f635988cd350df820616c02a0bc9c74e4a87cb51520f0d39a81ac89

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/11/2024, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
www.satnet.biz/Install.exe
Size 818KB
Sample241128-tzbzyssraw
SHA256 5f5198fc2d3e2896bacc006b79843ebc022bdaa704e4d0ea17531b99038376a6
MD5 a2cee1e2af064e875734ab3afb6a660e
SHA1 de51dccd8c72a51135db4c0ef1dfafc93eeac9d2
SHA512 9b733d4a3460143afbc96633f242c01d1f92d3d1ee3db76e859428bb7b8f1f635b5c616f4c6ea6321edd1aa60f34115f1b44190f89061e1c931aadcc8b5099c9
SSDEEP 24576:hwL/dHL3Vhr00qczLg1tF7MceAWuTMq8U3OF7nkPmSEz/C+bsm9:hwxHL3VhA09ngzF7MdAJgnmmdzBr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral3/files/0x00050000000193d1-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2836	JLCS.exe

Loads dropped DLL 6 IoCs

pid	Process
1508	Install.exe
1508	Install.exe
2836	JLCS.exe
2836	JLCS.exe
2836	JLCS.exe
2836	JLCS.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JLCS Agent = "C:\\Windows\\SysWOW64\\28463\\JLCS.exe"	JLCS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\28463	JLCS.exe
File created	C:\Windows\SysWOW64\28463\JLCS.001	Install.exe
File created	C:\Windows\SysWOW64\28463\JLCS.006	Install.exe
File created	C:\Windows\SysWOW64\28463\JLCS.007	Install.exe
File created	C:\Windows\SysWOW64\28463\JLCS.exe	Install.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JLCS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2836	JLCS.exe
Token: SeIncBasePriorityPrivilege	2836	JLCS.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2836	JLCS.exe
2836	JLCS.exe
2836	JLCS.exe
2836	JLCS.exe
2836	JLCS.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2836	1508	Install.exe	30
PID 1508 wrote to memory of 2836	1508	Install.exe	30
PID 1508 wrote to memory of 2836	1508	Install.exe	30
PID 1508 wrote to memory of 2836	1508	Install.exe	30
PID 1508 wrote to memory of 2836	1508	Install.exe	30
PID 1508 wrote to memory of 2836	1508	Install.exe	30
PID 1508 wrote to memory of 2836	1508	Install.exe	30

C:\Users\Admin\AppData\Local\Temp\www.satnet.biz\Install.exe
"C:\Users\Admin\AppData\Local\Temp\www.satnet.biz\Install.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\28463\JLCS.exe
  "C:\Windows\system32\28463\JLCS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 457KB
SHA256 571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe
MD5 46ccfd974518e5849738449034a05a17
SHA1 d391108816aed7ba8f7beb205ad7171c74eae6b2
SHA512 773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a
SSDEEP 6144:y3CPF9R/a4bR55krSGKLFLtqWwxSnvAHc/0QR86ll8h/9VGC9HK:l/agR0rSGKBLtPMEvAHL2lr
MD5 SHA1 SHA512 SSDEEP

Submit Download

JLCS.001

Path C:\Windows\SysWOW64\28463\JLCS.001
Size 414B
SHA256 1a101ca4079a177bf248d14221af41a88dc9e2044863bd56302b9291b305000e
MD5 bd0d040c89aa25d69ab36bcb22dc8961
SHA1 32537e888e4a63f4227b1521b88853482bde553a
SHA512 583864c0766d095be952111c3a03842d941ab52add9f834864c84e42f24b0145e8e2e2b772e40b220d201664c65e0827a9a58d5ad026ac728bd42ad9c311cc53
MD5 SHA1 SHA512

Submit Download

JLCS.006

Path C:\Windows\SysWOW64\28463\JLCS.006
Size 8KB
SHA256 7c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1
MD5 395bbef326fa5ad1216b23f5debf167b
SHA1 aa4a7334b5a693b3f0d6f47b568e0d13a593d782
SHA512 dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679
SSDEEP 192:IVdg5cxPjOhoZHOiX+/yWDpQzWXEM1DOcQs8O+y:Ik5cpOhSuK+/ynMEQfQ3O
MD5 SHA1 SHA512 SSDEEP

Submit Download

JLCS.007

Path C:\Windows\SysWOW64\28463\JLCS.007
Size 5KB
SHA256 8f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e
MD5 1b5e72f0ebd49cf146f9ae68d792ffe5
SHA1 1e90a69c12b9a849fbbac0670296b07331c1cf87
SHA512 6364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc
SSDEEP 48:6mn/3+o80EE/KD4XJQK5Gaayko1vmiXdjAECihnm8mMWrlo0P:6m0DMWaavoFRNsECi9mbrlo
MD5 SHA1 SHA512 SSDEEP

Submit Download

@62E8.tmp

Path \Users\Admin\AppData\Local\Temp\@62E8.tmp
Size 4KB
SHA256 27cfe74936e4090aafbef07ee45725923f4b1243135e1e3a51e3385dbcd7b637
MD5 a55cbc0f0125b005ef369020b4c17806
SHA1 010af3e2e84b337e91f5e0c791b01e1d527211ce
SHA512 88e5f7905c86d73bc5af028f20c8bf49f700307926c5b92814c245abe08e9c35841116d428ddbd7b957b47ccc8980684c12608b6818e4b6c1c8c0d27d54a07be
MD5 SHA1 SHA512

Submit Download

JLCS.exe

Path \Windows\SysWOW64\28463\JLCS.exe
Size 912KB
SHA256 4cf4bf2b7d2bb4215e255e1f2b1238ad989f3c8a98ebfd5cb033bccf32fedaa0
MD5 6768ba61744862704760b66ce8f8fdd4
SHA1 e86cbed8cf20c2a9c76219d0c434bc310ffb2392
SHA512 eadb56b633707724ef4f47f8b421b0f3b2afa5a9800fae030f81aefae483eed6b494da470278273f388c3ae346a33cbbfe742924d231dab1c9b42bbefaf95a61
SSDEEP 12288:UiTqJKIx33aV1XINaXOq6xGJOpqtAnWGgAIb3NEnCztPvnK3STFi:F4KEnaVIa/0Gkp0AWG1Imw83OF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1508-15-0x0000000002A20000-0x0000000002B03000-memory.dmp

Download

memory/2836-17-0x0000000000400000-0x00000000004E3000-memory.dmp

Download

memory/2836-27-0x0000000000400000-0x00000000004E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads