ardamax | c3e07b98a8da60e715048ccf35eb7cea372e76f40777f5f638d3a3a356a9e53f

Analysis

max time kernel
91s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe
Size 698KB
Sample240417-d7pm1scf89
SHA256 c3e07b98a8da60e715048ccf35eb7cea372e76f40777f5f638d3a3a356a9e53f
MD5 f4f3f5435f422b09978f05881db1ab4e
SHA1 6e73daf050cdbdb657bef4258e514a84a340ad7c
SHA512 d61a2b9815e6edd87fbda79e43e16680f9aa371a8c8bc79eb4aec4e00cc0bcc7238df21ddb784d14ac5e65667672509afabb8f6ba49fee1f16130c20fd44b3b7
SSDEEP 12288:m/PyRUz/5qSHSgndJUpwOymFkbKOfMLXZ5cX4RE2M6iSe68OsL5DOqY5DEfapAs:kKRsHRUPSbKO+XjcXYe68O4Y5DEfHs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002344e-37.dat	family_ardamax

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	Exporer32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	JTOV.exe

Executes dropped EXE 3 IoCs

pid	Process
2964	Exporer32.exe
2168	JTOV.exe
2984	Daemon Crypt V2 Public.exe

Loads dropped DLL 8 IoCs

pid	Process
2964	Exporer32.exe
2168	JTOV.exe
2984	Daemon Crypt V2 Public.exe
2168	JTOV.exe
2168	JTOV.exe
2984	Daemon Crypt V2 Public.exe
2984	Daemon Crypt V2 Public.exe
1968	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JTOV Agent = "C:\\Windows\\SysWOW64\\28463\\JTOV.exe"	JTOV.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\JTOV.001	Exporer32.exe
File created	C:\Windows\SysWOW64\28463\JTOV.006	Exporer32.exe
File created	C:\Windows\SysWOW64\28463\JTOV.007	Exporer32.exe
File created	C:\Windows\SysWOW64\28463\JTOV.exe	Exporer32.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	Exporer32.exe
File opened for modification	C:\Windows\SysWOW64\28463	JTOV.exe
File created	C:\Windows\SysWOW64\28463\JTOV.009	JTOV.exe
File opened for modification	C:\Windows\SysWOW64\28463\JTOV.009	JTOV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	2168	WerFault.exe	87

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2168	JTOV.exe
Token: SeIncBasePriorityPrivilege	2168	JTOV.exe
Token: SeIncBasePriorityPrivilege	2168	JTOV.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
636	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe
2984	Daemon Crypt V2 Public.exe
2168	JTOV.exe
2168	JTOV.exe
2168	JTOV.exe
2168	JTOV.exe
2168	JTOV.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 2964	636	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe	86
PID 636 wrote to memory of 2964	636	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe	86
PID 636 wrote to memory of 2964	636	f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe	86
PID 2964 wrote to memory of 2168	2964	Exporer32.exe	87
PID 2964 wrote to memory of 2168	2964	Exporer32.exe	87
PID 2964 wrote to memory of 2168	2964	Exporer32.exe	87
PID 2964 wrote to memory of 2984	2964	Exporer32.exe	88
PID 2964 wrote to memory of 2984	2964	Exporer32.exe	88
PID 2964 wrote to memory of 2984	2964	Exporer32.exe	88
PID 2168 wrote to memory of 2144	2168	JTOV.exe	101
PID 2168 wrote to memory of 2144	2168	JTOV.exe	101
PID 2168 wrote to memory of 2144	2168	JTOV.exe	101

C:\Users\Admin\AppData\Local\Temp\f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4f3f5435f422b09978f05881db1ab4e_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
  "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\28463\JTOV.exe
    "C:\Windows\system32\28463\JTOV.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 820
      4⤵
      Loads dropped DLL
      Program crash
      PID:1968
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\JTOV.exe > nul
      4⤵
      PID:2144
- - C:\Users\Admin\AppData\Local\Temp\Daemon Crypt V2 Public.exe
    "C:\Users\Admin\AppData\Local\Temp\Daemon Crypt V2 Public.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2168 -ip 2168
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@DD60.tmp

Path C:\Users\Admin\AppData\Local\Temp\@DD60.tmp
Size 4KB
SHA256 d5913b88289154f5979c03325b29f00d1d8c6a1e5f6195df915d96a46d0f71f3
MD5 a33680859a24229dc931c0e8a82ae84a
SHA1 dff1e7e7160ffbfaae221cd3a85de40722fddde6
SHA512 a419214699ab3478926fbb7f621a616e192eae22db20e72c83a4b529ba5307ab4dc906e0b1286bc4e4cb13ba1e28fb93fa4918c3ff7345273197e39c206c10bf
MD5 SHA1 SHA512

Submit Download

Daemon Crypt V2 Public.exe

Path C:\Users\Admin\AppData\Local\Temp\Daemon Crypt V2 Public.exe
Size 276KB
SHA256 07d7e4de0ffb5e3924ed2fbc08931526497f367d62b12a4503aededffe35e020
MD5 dfe516972fb621ff9a1dc714480cb9e0
SHA1 04ea4c2a0c49645991d2776a844977e8c9c5ed63
SHA512 1c385b7735f356ebc4466948046af664a8beae87b4c6719ab618c0f74db95c847d56bca920ac51e41597c2f39c0de66df6b35d2cd3d60c063a0a3bf5daefa5d7
SSDEEP 3072:19U5V6+a1MaXtQU5V6+a1MaPkW/27CbV8BGRAfU4LikpXLDGLQE5:1+5v8M+J5v8MyJbV8BGRA84ek9LD+T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Exporer32.exe

Path C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
Size 593KB
SHA256 f7573a2a9cc7c5ecbbd9530f72d19d4976aa826f2ec9688974888a41021aea41
MD5 17c1da8d5b5625cde1645e0e038dc989
SHA1 f4df06118bb79b395943bbeae9b7b99a6a6cba9c
SHA512 21234005e55998653b7932f0abfcfe53e3bb8040eccedf61999c2ef2fc90e7e5f947a9a7f857548ea33eae66e8b71561950ca494ecd110e06a1c154395ad68ef
SSDEEP 12288:8FyK9kqdPd++6m7ZQRXtTxUS2DaOFC92ALi8uS57TKVEc8PUubNt:SnkkhSRxGvRq2ALSS14E2uH
MD5 SHA1 SHA512 SSDEEP

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 393KB
SHA256 d7785409d6e2512d9d907670f79b313192a85138707c6ca0cc59a71f8fd6a247
MD5 1e13f68fd4258a545d262c77e38c76cd
SHA1 b8f6710c83e52ad354d8763a1b51293ee5758956
SHA512 938880407818a1489ecb9911cf05d4c9b69ecb2e0f908c3d3b8ba87b8c437ae16916e46bdf780bba24c38ad2c3981a5dcd4d3acd8ea227ac4dced12f1ca21eb3
SSDEEP 6144:tOn3jyjTAZcIA7Lb1GO3CFCbf8iIww/XV2N9jh3:Y3RZcIOhGj8bfmE
MD5 SHA1 SHA512 SSDEEP

Submit Download

JTOV.001

Path C:\Windows\SysWOW64\28463\JTOV.001
Size 486B
SHA256 8af31258752caecd8cfa8366ccd7773226760ac5d0f7c89a96cb13e3a6cbec3a
MD5 572cc4ec71193903d04c033b4610a41c
SHA1 7b3f063185c2bf905df0cb687caf7df07a6e442e
SHA512 dc3510d223cb6c1233017bbd5ebb039469c22fb7982ea256b2c12a6337920d673fbd8de82397746315dedccd29f5e2c5bbf24f5852af13ee8b3c57427569ba5e
MD5 SHA1 SHA512

Submit Download

JTOV.006

Path C:\Windows\SysWOW64\28463\JTOV.006
Size 7KB
SHA256 d7c7932d10e19ebde38c50583b4f5a0215a0ac88a2b131ea1b2a97824af759f9
MD5 46e0f5831dfe24c3105ef20190c5f0d7
SHA1 dbd701062695f9df971bffc1fa433eb18ef61727
SHA512 3dbe9e90f989ae3939d304f9f7822c3886e2d76ef575162e6a0518b61f5a52fcd8d0c63e06bbcf920c6f8298cb918ef5f3c0b92d42e99fa3eaabd787fc686a61
SSDEEP 96:6JZh3mtCh+B4ZQ3X0Fy+WXXCYTJ+cwMswHO1yWCj0GMRZQWHY2mIXT6pDD04Vx:q3mowZmyFXyY1chCCRZt4yD6p/04Vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

JTOV.007

Path C:\Windows\SysWOW64\28463\JTOV.007
Size 5KB
SHA256 cb8664787c631611643518ca2853f10ba9d460c25e476f55fb1b9f79838801fb
MD5 70c68ec7e4e7f18abf35d47976a47f0f
SHA1 f1263f67e712760e055833d3030ed4583611ad6f
SHA512 80cad83643c9c83be70809eebb4b662f58a323cbd5f1bfbc328722fbfa16f1a846f9ef159552a066850f12157cb7388d6ab37ea6f4e7563fff7cc26258b77a81
SSDEEP 48:6gklbiIoI0EE/KD4rJ2zxN03WlWyX35IECi1cBaVM+kHQ2k:6gSxDIm03W7n+ECiRQHQ2k
MD5 SHA1 SHA512 SSDEEP

Submit Download

JTOV.exe

Path C:\Windows\SysWOW64\28463\JTOV.exe
Size 471KB
SHA256 0f92918405d195ce10b0c897f07a73493d06e9e49505371a525d50cea75213bb
MD5 328ef8c28309203cfbe5655274d5ea48
SHA1 403399787e94f7d4e3c8e237e25399263e9f4047
SHA512 93dde6ab2d06af2d09b7f52619f2f475912152bbfd4b4ff93796eeffe7363f0ee777f4a46edb808039466fe0f82036dc291a378d4a8c6e407f0e1d4f3f6ea40a
SSDEEP 6144:zDuyzMYsea+Vt+0LdZM6bPu/nukFWJ/mv7BVau/bV7NcBC49YAb:PVlse5ZM6sukFWiVU7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/636-23-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/636-31-0x00000000006C0000-0x00000000006D5000-memory.dmp

Download

memory/636-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/636-1-0x00000000006C0000-0x00000000006D5000-memory.dmp

Download

memory/2168-58-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/2168-66-0x0000000002220000-0x0000000002221000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads