Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-01-2025 09:39
General
-
Target
Sro Pet Filter .exe
-
Size
1.1MB
-
MD5
812a0b8c11d100bdf10cf06d7b2e7842
-
SHA1
43404bb678a9b83112c019355a33833f1cc76abd
-
SHA256
c0a740688c19986853e92544d1b76e8e98f0c53da8e3aa37ccb89e559cae3bb4
-
SHA512
e7c068e46d23487f97b1dbfa597aebb9e01cb20dc800ea1cbeb4239800dc8d07efb91a8ea86b269fc28d4731b51d525d5f0ea6143aa20d8c22f22173aa28fd0c
-
SSDEEP
24576:CS/6JDU1ruPvqcGEAXK9PASGuEsavOX9y+1Nwc9sQQsmH/:CS841rAvKK+tuEs9tyUgsmH/
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sro Pet Filter .exe"C:\Users\Admin\AppData\Local\Temp\Sro Pet Filter .exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Sys32\GLUW.exe"C:\Windows\system32\Sys32\GLUW.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\SRO Pet Filter.exe"C:\Users\Admin\AppData\Local\Temp\SRO Pet Filter.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
675KB
MD5b1e577c0db8048ad9c4e51c45b2f825a
SHA12405b21a4767f822040b73bbb5adc152f2c26c1d
SHA2560759e05c395e024acebd7884726021839377d045c71d5185d02555f6db3e88c0
SHA5127da0fb7dc20ed81aa98db3ff140f1ba452099cf553b19bdb52be10f9a83652fb3fc540cb96837f535bbfa9c045e3955454fc38d99eac560d0947f38de9a4ae42
-
Filesize
391KB
MD5869461e168a87283a8782e70f5d5a3a8
SHA1ab189b5f2682ae66162226b4f646b1e80486c653
SHA256992cb5ea845b2d24c02f4e40873bf4ebd7b58b57ae2e001907228af4879e575b
SHA512e4e77e07eb0ef2adb6d5ebdb9629f4632c417cf3d1a22e4c414b806bfbd259df13f6c88265f9346ed2b22bf67eb3d63924d86767c8508be4abdc9067f15a82ae
-
Filesize
378B
MD559cbd67b1b5822e7fc2310369c3da461
SHA171602325f6b32f3e4d5882b0b1c61598ab64dad7
SHA256da350c7ee04088166a1775276a9f7107b9fbf51206225fecb6610cbd5f5c61ad
SHA512f7f609c8a6508a646444911843094f44ca35fbfe8c75c8851ceb635fec9a22a9ebf2c7d7492941e14674107682fe2eee6cb0b6eb35e42084f9c136664a13cfd0
-
Filesize
5KB
MD53e1f5d5a06cf97b0495b8d129fbe02e4
SHA1b0de258a813f5edde85004f6865b6ed91f6d6f8f
SHA256f49448fc7c567e64eaeb9cc4dbd3c8021a82b5d9df0a622a439f7b42dc2f26d7
SHA512b0e0b81cb5776d298e96346aa61027c9799a47191c94de50be2209c32747774959d002ddeb98fd15556ee893b0d7bd1f0c8a901469dce4e3acf94e2c4c3e2bfd
-
Filesize
4KB
MD533303ca8abef9221cb410b8a232e9fe4
SHA10cdfc25dbf0e9ad7d4585cd9037dc2e6604be00c
SHA2565110301dee966f0f26307ab1b430279d1e4999c2c4a0ea924ff32f1a9ded869a
SHA512da29821045773ba776def985966b62e09e69bb5bf1786b16c2fff6feb68a03b9e22c5f7d081e3dd58d1785cd7ac64736497c043b7cf6c7149c3a54f8ef111800
-
Filesize
7KB
MD5928cc65dc793834c709a054ca57c19c8
SHA1a1e5d8407199c1bd6a4b274044de640fe0d9e99b
SHA256e3473d81a02ed30e4236591384136f41f17b6a4aae24b5468789644ccd4bf192
SHA512f7c8f7a75c4f8a418630e2ac15676740a902449d9a3c4baf3184409f8701c9caa3e82304d141362d95503f1af6b693eed7b77f690d92ca0162f7ea3ecbc80fdf
-
Filesize
476KB
MD5ef52b540cb404d908338e9cbf7cff283
SHA1778765e1736c0a197685978c3fee7a44e7bde419
SHA25639d8bdb975fbfcbcec8fe63be4e9fe6ce39ae5d23a005118aeffa07b17a3f815
SHA512596b77bf5b15455c326a5a2efd66bc69685eb625e3e211ea0341ad4d8920ada7618a7107e42f2c0963fe6c2d92f2acf47b641ef33071a7c42004e5874d5219a6
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
1.1MB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB