ardamax | 0510651b5b1269059c6ebcaafbb770ac7cce1850f7b3c2508b83ed311afa7e86

Analysis

max time kernel
122s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
Size 1.2MB
Sample240416-vfdvwagh8y
SHA256 0510651b5b1269059c6ebcaafbb770ac7cce1850f7b3c2508b83ed311afa7e86
MD5 f3e95567ee9ece690c044ea8447d91c7
SHA1 e23380d8bbd5fcd5f435aae29ac925533fcdf3d0
SHA512 31d92cb87c477eaf5594e659415a1c02e4ca76202746da71d8b0ac1d48cd079de5f9b65bce413d729a5083726ec99aa6b6cb01371eafa2a6cdb8a54955284c6d
SSDEEP 24576:f5z9C4nqDGvx09BTw4VkFpSg3MQxs7LEd5vSelzY6Mba1psk0nj4Q:f5z4Kzvx03DmpSg3BxgLEd56e+6wmukU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233ed-14.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
548	PHI.exe

Loads dropped DLL 1 IoCs

pid	Process
548	PHI.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PHI Start = "C:\\Windows\\SysWOW64\\TEPNMS\\PHI.exe"	PHI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TEPNMS\PHI.001	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TEPNMS\PHI.002	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TEPNMS\AKV.exe	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TEPNMS\PHI.exe	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\TEPNMS\	PHI.exe
File created	C:\Windows\SysWOW64\TEPNMS\PHI.004	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3664 set thread context of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	548	PHI.exe
Token: SeIncBasePriorityPrivilege	548	PHI.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
548	PHI.exe
548	PHI.exe
548	PHI.exe
548	PHI.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 3664 wrote to memory of 4488	3664	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	86
PID 4488 wrote to memory of 548	4488	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	87
PID 4488 wrote to memory of 548	4488	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	87
PID 4488 wrote to memory of 548	4488	f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f3e95567ee9ece690c044ea8447d91c7_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\SysWOW64\TEPNMS\PHI.exe
    "C:\Windows\system32\TEPNMS\PHI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\TEPNMS\AKV.exe
Size 463KB
SHA256 96af80e7ba0f3997d59ebcb5ecef619f980d71ca29113e2cd2f2e8adcdea3061
MD5 eb916da4abe4ff314662089013c8f832
SHA1 1e7e611cc6922a2851bcf135806ab51cdb499efa
SHA512 d0dbe1d1612982b9cd2a3ed3cbd3e3b5be49237f580f91d5e5d5b6d20ed4dc0babb69a666c19bf4e0f10776a43b9b1dcda91a4cd381ce3705b1795ef9d731c8b
SSDEEP 6144:k1+xTZXVYwi0VrQLS0jOQk+gAmRxYqBAygw/lV7MXm7nvhe1gSD1Md:0wFFXVrQGsOQXZ+CGAyNhe1fD1Md
MD5 SHA1 SHA512 SSDEEP

Submit Download

PHI.001

Path C:\Windows\SysWOW64\TEPNMS\PHI.001
Size 61KB
SHA256 70b00b09ae76a7ecfd6680ab22df546b17826755087c069fc87d14895e1a4e24
MD5 425ff37c76030ca0eb60321eedd4afdd
SHA1 7dde5e9ce5c4057d3db149f323fa43ed29d90e09
SHA512 ef5ff97c0d682b6155eff8f92dace1789cf01ca8bca55af1c1d0f2243b5e18bc12a657bb2bb12601b51ef9e1b942f02feb8462644da291fd1b2239c34ef2b59b
SSDEEP 768:t5RUHzUzl212q7YJRNSRBTZuX2LEH0GB2jPezHXR3rcFiTJn45nEV5U:Go01MJHONsX24U1Pezh7PC5nEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

PHI.002

Path C:\Windows\SysWOW64\TEPNMS\PHI.002
Size 43KB
SHA256 4de0c277800ae36b85a11ed9765f732a73578d4dce053ff7179f96ab776fb60d
MD5 12fb4f589942682a478b7c7881dfcba2
SHA1 a3d490c6cda965708a1ff6a0dc4e88037e0d6336
SHA512 dd1c6a4ea5bc9698701ec941c4e90fe8dfb0993dc321edc052d1a80cc49bc46be665a85ec678876e698de60cda5dbf1d6279742a16d648f9d18e642a3ea33ddd
SSDEEP 768:zipMkSRrW+sXubaqE7PsdxxQvjPj2iQ01kpNwMRW5:mpfpXRPsdxx4PSUkJRW5
MD5 SHA1 SHA512 SSDEEP

Submit Download

PHI.004

Path C:\Windows\SysWOW64\TEPNMS\PHI.004
Size 1KB
SHA256 e99d37356a0b756d11288a11b9f97f3b0835a681a46c9ab7c214d8ac5f5691da
MD5 91a2da7eb87a79d2f52e84961818c991
SHA1 bb96c87fe3b8eafa11b209711c08cc161231fe1f
SHA512 a4246f6d313041d50ed69a9bf7180771db021f34bc9ab3a0cdaf05d3baf78ed6b868f6534163bf56e9e75942ce762b7535c37d91e5821cb350c4010d584f1075
MD5 SHA1 SHA512

Submit Download

PHI.exe

Path C:\Windows\SysWOW64\TEPNMS\PHI.exe
Size 1.5MB
SHA256 734439c4049ae1a832b4cc5c8d227112106406945d1a7cbb355e11a3f5e356c4
MD5 f8530f0dfe90c7c1e20239b0a7643041
SHA1 3e0208ab84b8444a69c8d62ad0b81c4186395802
SHA512 5cb01517938789e006e00d69729ae7d73ad480f1ae17a80059bf81ee5d9cebb1263a35732c84f03d742684a650b116b13e6731ca80b0b9cdb3908e5588649399
SSDEEP 49152:YhM1+MJKDL0X2Q+BIMUwqv68ThprZalIEjL:YhM1+MJKDL22QMI006NbjL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-24-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/548-26-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/4488-2-0x0000000000400000-0x000000000051F000-memory.dmp

Download

memory/4488-3-0x0000000000400000-0x000000000051F000-memory.dmp

Download

memory/4488-4-0x0000000000400000-0x000000000051F000-memory.dmp

Download

memory/4488-8-0x0000000000400000-0x000000000051F000-memory.dmp

Download

memory/4488-18-0x0000000000400000-0x000000000051F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads