download:

Keylogger.Ardamax.zip

Full analysis: https://app.any.run/tasks/8706cfdb-f7a4-454e-a9db-6de62e95de53
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: October 16, 2020, 09:07:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

5DE75A478FFB3AA01A88F4E539F3EDC0

SHA1:

D4DBBDD4A8888B6B0738471E2E422C26F7E2F81B

SHA256:

9C662E2C950E9CBA8367A47F628553291F1E26B7E897A8533C00A4B27E174227

SSDEEP:

12288:9xq9i8r/n4c9ahANC6hddXrnD1v0bcijRd3byyzwgLE7EYY6GHKNwUdHlwYPwoG2:e9BjnbZX18bLRdrcp7lY62KquOYop2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Renames files like Ransomware

      • explorer.exe (PID: 392)

    • Application was dropped or rewritten from another process

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 2552)
      • DPBJ.exe (PID: 1544)

    • Loads dropped or rewritten executable

      • DPBJ.exe (PID: 1544)
      • explorer.exe (PID: 392)
      • ctfmon.exe (PID: 688)

    • Changes the autorun value in the registry

      • DPBJ.exe (PID: 1544)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 2552)

    • Writes files like Keylogger logs

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 2552)

    • Creates COM task schedule object

      • DPBJ.exe (PID: 1544)

    • Creates files in the Windows directory

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 2552)
      • DPBJ.exe (PID: 1544)

    • Removes files from Windows directory

      • DPBJ.exe (PID: 1544)

  • INFO

    • Manual execution by user

      • ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe (PID: 2552)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2013:06:06 16:22:15
ZipCRC: 0x5f827015
ZipCompressedSize: 796882
ZipUncompressedSize: 802724
ZipFileName: ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe dpbj.exe explorer.exe no specs ctfmon.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
688C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1544"C:\Windows\system32\28463\DPBJ.exe" C:\Windows\system32\28463\DPBJ.exe
ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\28463\dpbj.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2496"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Keylogger.Ardamax.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2552"C:\Users\admin\Desktop\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe" C:\Users\admin\Desktop\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\ardamaxkeylogger_e33af9e602cbb7ac3634c2608150dd18.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
Total events
2 347
Read events
2 251
Write events
96
Delete events
0

Modification events

(PID) Process:(392) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000715ADFA7488BC749A232B87DA37A17C700000000020000000000106600000001000020000000EC975CD5A2A4421A29242F4AB30A5F5C88418A8EFFDC83FC4261062BF2EF84E5000000000E8000000002000020000000A04E604AD9AE1B8A81E9E5CB6192435841F61FDA47242C6F50BE0E4D2CA2035030000000EBC8B69DED4FCA51506D663E527A956120D14832F5DF785E111D2F01AFAA5395E369FF2BD455CFE0D899AE46FA0C379E40000000B39607C057F49F9A70A66E0947C70F929B9E34904BA32AF0961B05560208CF51ABC13F5C857D0444BE28461CC0FC5A0730FA542E6FAD06629FB0B62DF7B18930
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2496) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Keylogger.Ardamax.zip
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(392) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
(PID) Process:(392) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
Operation:writeName:MRUList
Value:
a
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2496) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
6
Suspicious files
13
Text files
57
Unknown types
0

Dropped files

PID
Process
Filename
Type
2496WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2496.10039\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18 —
MD5:—
SHA256:—
2552ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exeC:\Users\admin\AppData\Local\Temp\@BA1D.tmp —
MD5:—
SHA256:—
1544DPBJ.exeC:\Windows\system32\28463\Oct_16_2020__10_08_20.jpgimage
MD5:—
SHA256:—
1544DPBJ.exeC:\Windows\system32\28463\Oct_16_2020__10_08_18.jpgimage
MD5:—
SHA256:—
1544DPBJ.exeC:\Windows\system32\28463\DPBJ.009binary
MD5:—
SHA256:—
1544DPBJ.exeC:\Windows\system32\28463\Oct_16_2020__10_08_19.jpgimage
MD5:—
SHA256:—
1544DPBJ.exeC:\Windows\system32\28463\Oct_16_2020__10_08_21.jpgimage
MD5:—
SHA256:—
1544DPBJ.exeC:\Windows\system32\28463\Oct_16_2020__10_08_23.jpgimage
MD5:—
SHA256:—
1544DPBJ.exeC:\Windows\system32\28463\Oct_16_2020__10_08_24.jpgimage
MD5:—
SHA256:—
1544DPBJ.exeC:\Windows\system32\28463\Oct_16_2020__10_08_25.jpgimage
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
3
Threats
2

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1544
DPBJ.exe
188.125.73.26:587
smtp.mail.yahoo.com
—
CH
unknown

DNS requests

Domain
IP
Reputation
smtp.mail.yahoo.com
  • 188.125.73.26
shared
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1544
DPBJ.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
1544
DPBJ.exe
Generic Protocol Command Decode
SURICATA SMTP invalid reply
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Keylogger.Ardamax.zip