MALWARE ANALYSIS
Ardamax Keylogger: Static and Dynamic Analysis
A walkthrough of the sandbox setup, PE inspection, API analysis, debugging, and resource extraction described in the report.
This article is a Medium-ready adaptation of the original malware analysis report. The technical observations, tool names, file names, API names, and workflow are retained from the report, with the prose cleaned for readability.
Safety note: Malware execution should be performed only in an isolated analysis environment such as a properly contained virtual machine. The original report describes disabling security controls for behavior simulation; that should not be done on a normal production system.
What this analysis covers
The report analyzes Ardamax Keylogger using both static and dynamic techniques. The investigation follows the sample from initial triage and string extraction through Portable Executable (PE) inspection, resource extraction, API analysis, IDA Pro debugging, and observation of the keylogger’s execution flow.
Malware Analysis Report Malware: Ardamax (Dynamic and Static) Keylogger. Malware analysis is the process of studying malicious software, or malware, to understand its functionality, origin, and potential impact. In this report I have tried to analyze the ardamax keylogger. Ardamax Keylogger is a commercial computer program designed to monitor and record keystrokes on a computer or device where it is installed. Keyloggers like Ardamax are typically used for legitimate purposes, such as monitoring computer activity on one’s own system, tracking employee productivity, or recovering lost data. However, they can also be misused for malicious purposes, such as capturing sensitive information like passwords and personal data without the user’s consent.
It can enter one’s system by various methods:
· ~Bundled with Other Software.
· ~User Downloads and Drive-By Downloads.
· ~Social Engineering.
TOOLS USED
Tools uses:
VS code / Notepad++ (as a text editor) PE-bear HxD hex editor CFF Explorer VII or CFF Explorer VIII PeStudio ResourceHacker IDA pro (v8.3) Procexp (process explorer)
Building the Malware Analysis Sandbox
I have tried to create a malware analysis sandbox. This set up to dissect the malware in both static and dynamic way. I have used Windows 10 to set up this environment, I have downloaded the Flare VM. I have setup this OS in virtual box and allocated necessary memory for it. Downloaded necessary tools or apps like chrome, 7zip,
This is the screen of the windows 10 os im using, as you can see I have installed flare vm. The sample could be downloaded from “”. Make sure you choose this option. This malware is of type keylogger and basically attempts to steal your keystrokes to benefit from doing so, as it can sensitive details of the user. It has self-extracting archive (SFX) which is a raw file. By copying the Target id into Virustotal website, we could get an insight about the malware.Now we download our sample in our windows 7/10. Also to unzip your file you’ll have to have a 7-zip executable which will enable you to unzip by using the ‘infected’. Now we rename our file into ‘ardamax.ex’ so that we don’t want it to get executed. During this process, we have to turn off our windows firewall because, allowing unrestricted network traffic, ensuring accurate behaviour simulation.
Initial Static Triage with Strings
We have downloaded all the necessary tools and software for dissecting and analyzing this malware. We now open the command prompt and go into the desktop. ‘cd Desktop’ Then we give a command ‘strings ardamax.ex > out.txt’
which is a part of sysinternals. Its not a default feature so make sure to download it from “https://learn.microsoft.com/en-us/sysinternals/downloads/strings” and extract the file . Make sure to add the path of strings into your path of environmental variables settings ( in system variable select path and click ‘edit’ then add ‘new’). Now we are adding the path of stings which we downloaded. Click ‘ok’ for the windows then try the strings command again . It would work fine now .Now on running the ‘strings ardamax.ex > out.txt’
New text file is created and opened in VS code as it is a recommended text editor. When you open it in VS code and scroll all the way down , towards the end it specifies the privileges ( as in admin or user etc..) It is recommended to go through the text file and note interesting lines in the notepad like below. We note these down as it might be a possible IOC (indicator of compromise). IOC could be file names, hashes, security related values (encrypted keys and many more), IP addresses and folder names (any indicator that can identity an attack happening in the network). The notepad would look like
How the Keylogging Mechanism Works
Now lets see how the inner keylogging
mechanism works:
METHOD
1. 1. Execution of the dropper Ardamax.exe, which drops several files,
including a randomly named DLL to the %temp% folder.
2. 2. The malicious process Ardamax.exe loads the dropped DLL that is
used to drop the keylogger files under a hidden folder in the system folder.
3. 3. Finally, the keylogger DPBJ.exe is executed, logging keystrokes
and capturing screenshots. Once a victim launches the dropper, Ardamax.exe executes its initial routine GetTemp_Path (sub_401230), which obtains the Windows
%temp% path, for later use, as shown in the following screenshot:
The call to GetTemp_Path function By looking at the disassembly output from IDA, the GetTemp_Path function calls GetTempPathW to retrieve the system’s temporary folder.
The GetTemp_Path routine and its GetTempPathW call.
The GetTemp_Path routine and its GetTempPathW call.
The call to GetTempPathW The next routine calls CreateFileW. In this routine, Ardamax drops several files to the temp folder, including a randomly named DLL, as we mentioned earlier. The call to CreateFileW Using Process Monitor, it is possible to see the randomly named DLL being copied into the folder. In this case, the DLL filename
is @F9CD.tmp:
The CreateFileW routine and Process Monitor evidence of the randomly named DLL.
The CreateFileW routine and Process Monitor evidence of the randomly named DLL.
Ardamax loads the randomly named DLL using LoadLibraryW. If the DLL load is successful, the dropper will call GetProcAddress to get the DLL’s sfx_main address. Get sfx_main address The following screenshot illustrates the operation above in a dynamic
execution flow:
Next, the dropper gets a string containing the system’s main directory, which is either System32 or SysWow64, depending on the system architecture. Then, according to a hardcoded string, the dropper creates a hidden folder with the hardcoded name “28463” and copies several files into it. The batch of files will include DPBJ.exe, which is the actual keylogger.
Loading the dropped DLL with LoadLibraryW and resolving sfx_main with GetProcAddress.
Loading the dropped DLL with LoadLibraryW and resolving sfx_main with GetProcAddress.
Creation of the hidden folder under the system folder Once all files are copied to the designated folder, the main file of the
keylogger dubbed DPBJ.exe is executed with ShellExecuteW:
Creation of the hidden folder and execution of DPBJ.exe with ShellExecuteW.
Several files are dropped into the hidden folder and execution of the keylogger begins.
List of files copied to the hidden folder
The list includes the following files:
· ● DPBJ.006 & DPBJ.007 — DLL files that are loaded by DPBJ.exe in
runtime.
· ● DPBJ.exe — Keylogger’s main executable.
· ● key.bin — Keylogger’s license serial key (Still in research).
· ● Other files that didn’t seem interesting for our research
purpose. Using Process Monitor again, it is possible to track the behavior of the hacking tool and its use of the hidden folder. The screenshot
below illustrates how the “DPBJ.exe” file is being called for execution:
Dropping of DPBJ.exe
Files copied into the hidden folder and Process Monitor evidence of DPBJ.exe execution.
Files copied into the hidden folder and Process Monitor evidence of DPBJ.exe execution.
Execution of DPBJ.exe After the keylogger is executed, it starts to collect the victim’s keystrokes and screenshots. Next we search for SetWindowsHookExW as it was given in the (reference- Knowledge Library » TrainSec in which “ Dissecting Ardamax Keylogger » TrainSec “) . This particular function can be used to hook mouse or keyboards. This can be told by “push 2” which lets us infer that, which pushes the value 2 into the stack . In the following routine, the SetWindowsHookEx function is being utilized with idHook of 2 (WH_KEYBOARD) that handles keystroke
events and thus logs them:
The keylogging mechanism itself was based on SetWindowsHook Windows API function, basically it can hook in the system like mouse, and it uses several Windows API functions to capture screenshots in runtime.
· ● SetWindowsHookEx — Keystrokes logging
· ● GetDesktopWindow — Screenshot taking and more.
SetWindowsHookExW-based keylogging and the related API call flow.
PE-bear: First Look at the PE File
Windows API functions are being used for screen capture. The captured Screenshots will be stored in folders automatically. Here whenever the function is being called, it uses the parameters of functions in the stack, which were already pushed before.From this you can see parameters are like idHook is of int datatype. Using Autorun, it is possible to exhibit the Agent’s registry path and
the executable location:
Next we use the tool PE-bear. It can be downloaded from ‘https://github.com/hasherezade/pe-bear/releases’ . PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files. PE-bear allows users to open and inspect PE files to gather information about their structure, attributes, and contents. A key point to be noted is that windows defender should always be turned off and it gets turned on if the user is inactive for a while, which will prevent you from analyzing the sample with PE-bear.
Autoruns evidence followed by the PE-bear static-analysis view.
To run the PE bear you need to ensure the Microsoft Visual C++ redistributable package from Microsoft’s official page. Make sure to install both the x64 and x86 versions if you are unsure of your system type. And add those in the environment variable path.
Now once the windows defender is turned off , we would be able to open the tool and simply drag-drop the ‘ardamax.ex’ into the tool and the screen would appear like shown in the picture. Demonstrating how to turn off windows defender. This is the home page of PE bear, where you drag the executable malware file and drop here.
Now you can see the inner contents of the file clearly.
Hex Analysis and PE Headers with HxD
DOS Hdr — contains some important informations. Like Magic number- 5A4D which we have to read in little-endian (reads basically from least significant bit) format. To see the values of the magic number conversion form the decode form when we use the hex editor(Downloaded it from https://download.cnet.com/HxD-Hex-Editor/3001-2352_4-10891068.
html). This is the output shown:
Here this part is the header of the file. From this we infer that this tells this file is a portable executable file so we have here the PData. This indicates these are part of the book, for example text section.
HxD view of the PE header and the MZ magic number.
Imports and Windows API Functions
Now we go to the imports we can see the functions which are imported from the dll files , you can see some windows API FUNCTIONS, which gives the token privilege of the currently executed user. We can use this to escalate the privileges.
If we go to Kernel32.dll, we can see many functions like:
Writefile- from the name it says it does write to the file
Imported Windows API functions visible during PE analysis.
Imported Windows API functions visible during PE analysis.
These functions are used for anti-debugging purposes Now if we go to GDI32.dll
GetDeviceCaps:
CFF Explorer and PeStudio
Next we use the tool named CFF Explorer (drag-drop into the tool , shown in Fig.17).The tool could be downloaded form ‘https://github.com/cybertechniques/site/blob/master/analysis_tools /cff-explorer/index.md’.
Next we also use another tool named PeStudio. PeStudio is a portable and free program which is able to examine executable files in depth. It supports both 32-bit and 64-bit EXE files.
Resources and ResourceHacker
Using hxd editor we must have seen rsrc source which is helpful for storing GUI stuffs like icons, another executable file it is. The resource section lets us identifies various files sometimes even hidden execute files that we aren’t aware of .
Next up, we use ResourceHacker and it can be downloaded from “Resource Hacker — Free download and software reviews — CNET Download”.Resource Hacker is a free and popular utility used for viewing, modifying, and extracting resources in Windows executables and resource files. The tool allows you to view and edit various resources embedded within Windows executable files (such as .exe, .dll, .ocx) ,resource files (such as .res) and to extract resources from executables and resource files. This can be useful for obtaining images, icons, or other resources for personal or development use.
4D 53 43 46 these values stand for Microsoft Cabinet File. Cabinet is an archive-file format for Microsoft Windows that supports lossless data compression and embedded digital certificates used for maintaining archive integrity.
Here, Express extraction tool is used for detection of signatures
Cabinet file is for us to focus on so we save its .bin file . Now we put it in the HxD hex editor. This mostly consists of gibberish stuffs. We try to save as cabinet.cab as cabinet.bin doesn’t work.
Get Durga Nandhini’s stories in your inbox
Join Medium for free to get updates from this writer.
If we try to open and see :
These executables were already on our list of IOC’s which we derived by using string command. Extract these to the desktop. And drag and drop to the PE Studio, and by that you can see they are malicious.
Moving to IDA Pro
In the section area, we can spot the entropy. This value lets us know the indication of the intensity of the malware. If its entropy is higher than 7 then its one of the indicators that it’s packed. They both are 32-bit. Next we use IDA Pro which can be downloaded from “https://download.cnet.com/IDA-Pro/3000-2218_4-10800676.html” latest version (v8.3). IDA Pro, short for Interactive Disassembler Professional, is a widely used and powerful software tool primarily used for reverse engineering, binary analysis, and disassembly of executable files. We use this software ad from the CFF explorer we can infer that it is compiled using C++ and then we are using IDA pro.
Check load resource Now we go imports, which has varied functions. We can start exploring various interesting functions.Here as you see, there are many things which has been noted down in notepad.
Double tap on any thing you want to see:
The function is stored in idata which basically stores the addresses that points to the actual function.Just click on the function , then click on ‘X’ on your keyboard.
It’ll provide a cross reference and we can get directly to the function
itself.Just double click on the highlighted and it takes you to:
Now we add breakpoints and start the debugging process.
Now we’re trying to find who is calling the function sub_140008874. Again click “X” so we now identified where it is starting from (double click start+4)
Maybe this could be the start function. Now we can view the entry point (Ctrl+E ). It’s a wise practice while analyzing the entry point when we are doing malware analysis.
Add a breakpoint in the start function . Now we start debugging and wait for it to stop its execution. Use a local windows debugger. On running we get this screen. This is where the execution has stopped.
Dynamic Debugging and Process Analysis
When F7 is pressed it takes us further into the subroutine. Close windows like Output, Threads, Modules. Leaving the thread windows is advised to be open when we have multithreaded scenarios.Now when we use F8 it executes the subroutine without going into the code. Now we F8 until we reach the “GetCurrentProcessID” Now we’re trying to find the decimal value of the register value.
Do have “procexp” and it can be downloaded from “Process Explorer — Sysinternals | Microsoft Learn”. From which we can infer that the port no 3628 is active and is used but ardamax.ex file and that is shown in the Procexp .
Our findings are that it is not an antivirus mechanism.Now we change the breakpoint to the start of the program.Now run the debugger.Now we directly set our IP to the jmp statement then click F7 to go into the subroutine . We do this to check if it runs in the path or behaves differently.
An interesting point to be noted is that this file is written in C++ and there is definitely a main function. So it’s safe to assume that there were no functions before the main function and that is the starting point. Now we just go into the program and analyze all the functions written for each and every process. They are GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount and QueryPerformanceCounter. As we scroll down. We notice that the function is returned.
Here we the view of the flow could viewed in different format by pressing ‘space’ button. Now we add breakpoints at all the ‘exits’
Now Fig.1 and Fig.2 show where all the breakpoints are set. On pressing F5 we can decompile.
This is the view of the decompiled code side by side. On right clicking the function, we can choose synchronize with option so that when we navigate through the flow the code will also show the corresponding line in the decompiled pseudo code area. Now as we move through the workflow and various functions we come across functions like resources (FindResourceA, LoadResource, LockResource,SizeofResource) . Basically five of these help in the extraction of resources. While executing the malware, if it has a path for itself it takes the Mutex function. If it doesn’t exist then it creates one. This whole process is a mechanism of self-checking.
We open resource hacker for analysis and we put the program inside.
This is the cabinet section of the program under the RCData file. This has string and hexa values. The cabinet file is a raw or zip or Microsoft format. We extract it by right clicking and saving it as b* in the desktop . In order to analyze the code, we are using IRD. Before that we have to have an overview of the portable executable. So we open CFF Explorer and we load the ardmx file . By doing so the following result
is displayed. So, the file is portable executable 64 bit and compiled with visual c++. It is also important to know which kind of compiler is used. As it is portable executable , it is not necessary for it to be of c++ code in order to compile it. It can be of python and be compiled with pi installer. But for .net we can’t compile using this tool, we have to use tool like spy. As the malware is 64bit we use IDA 64 to analyze. Now, we open the software. This mainly disassembles machine code to assembly code.
Deeper IDA Analysis
We have to load the ardmx file into IDA. After loading it , tick load resources for the IDA to parse and press ok. Then, we will be taken to start of the program. It looks like this.
To find the entry point press Ctrl+E, this will show the start entry point. Sometimes there might be many entry point . In this case there is only 1 entry point.
Most malwares have TLS functions which are executed before the main function. Here in our program we don’t have that. We have to analyze the main function properly. So we go to the first function i.e the __security_init_cookie. We double click this and we obtain this. The function gets system time, carpool id, thread id. It tries to understand in which state it is. It calculates get the count function in microsoft documentation i.e the query performance counter. The first instruction is a cleanup function. Here 28h in hexa stand for 14 , so it takes the memory in the stack and subtract it. When you subtract memory in the stack you give more space for the function to take more arguments or parameters for the execution of the function The add function , cleans the stack by rsp 28. Rsp is the stack pointer.
After the stack is cleaned, there is code for another function. There are functions used here like startup and sleep. We can use space button to change the overview of the code.
We have a lot of functions like Windows API function and exit functions. In order to check whether there is any anti-debugging mechanism we set breakpoints of exits.
After setting the breakpoint, we can change the view again by pressing space button. There are a lot of exceptions and check here.
By pressing f5 , we can change it to C code. We minimize the window and keep it side by side with the graph overview of the function window.
By right clicking and pressing synchronize with IDA-A, if we press a function it will show the result of the function the graph overview window. In the above image it is shown. The instruction will be highlighted. We got to the end of the C subrouting and find that there is a loop over to this function. After going to that function, we press Ctrl+E and see that there are 2 entry points to this function.
We double click the function and see that it gets the version, mode of the kernel that holds processes like create processes and other.
We got to this function to analyze.
Resource Extraction and Mutex Logic
There are functions for versions check and we assume it is related to gui. We go to the CreateMutex function,. We double click on the resource function and here there is string instant check. If this instant does not exist it will take this function first of all, if it doesn’t exist it will extract something from the resources. There are 4 Windows API function defined, Find resource Size of resource
Load resource Lock resource Free resource All the 5 functions, mainly the first 4 functions are used for resource section extraction. We place a breakpoint in the function and analyze it dynamically.
It will find resource with a specific name. The name in this case is populated dynamically, it means that there is no hard coded value here, while we run the program we see the actual value. Now we go back and check . there is a test and jump not zero which is basically compares if with jump zero or jump not zero and vice versa. So, it will take the resources and create and see whether this instant check value exists, if it exists it will go to a routing , if not it will create mutex value . So if the malware will try to run again , it will do a self check for the malware again.
Then , it will zeroize the values of r9 and r8, jump and call this function If there is no mutex, it will be created. This is the basic functionality. Now we try to open it again in resource hacker.
Finding the Cabinet Extraction Routine
We now see where this cabinet resource name is in the code. So we rename it . Now, we check for the the name in the code. Now, we go to start of the function and do Alt+T for search
This is the search result->
We go this call of the function.
We search for the function in google, and find that it is part of the FDICopy function. Part of fdi.h header file of C. It basically extracts files from cabinets .
Signatures used:
CONCLUSION
We saw a rather simple flow with features that are not unique enough to rate Ardamax as a strong offensive tool, but enough to evade some detections.
Key Findings
· Ardamax follows a dropper-based flow in which the initial executable drops files, including a randomly named DLL, into the temporary directory.
· The dropped DLL is loaded dynamically, after which files are copied into a hidden folder under the system directory. The report identifies DPBJ.exe as the main keylogger executable.
· The keylogging mechanism is associated with SetWindowsHookEx using idHook 2 (WH_KEYBOARD), while screenshot collection uses Windows API functionality including GetDesktopWindow.
· Static analysis exposed imported APIs, PE metadata, resources, entropy information, and an embedded Cabinet resource.
· Dynamic debugging and cross-reference analysis were used to follow execution, inspect functions, place breakpoints, and investigate resource extraction and mutex logic.
· The report concludes that the flow is relatively simple and does not rate Ardamax as a particularly strong offensive tool, although its features can be sufficient to evade some detections.
Conclusion
The analysis presents a rather simple flow with features that are not unique enough to rate Ardamax as a strong offensive tool, but are enough to evade some detections. The combination of static inspection and dynamic debugging makes it possible to understand how the dropper, DLL, hidden files, keylogger, resource extraction, and mutex/self-check logic fit together.
Tools Mentioned in the Report
· VS Code / Notepad++
· PE-bear
· HxD Hex Editor
· CFF Explorer
· PeStudio
· ResourceHacker
· IDA Pro v8.3 / IDA 64
· Process Explorer (Procexp)
· Process Monitor
· Autoruns
· 7-Zip
