ardamax | 238b0e5bd34df4a6cda3232a5e65da5d2b6291a3ad4838b417043aee2eda1cc8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe
Size 1.8MB
Sample240420-srxe9aca5x
SHA256 238b0e5bd34df4a6cda3232a5e65da5d2b6291a3ad4838b417043aee2eda1cc8
MD5 fd117e9054e30aa6722b9207518e5e67
SHA1 4c8cb147acaa046ffce44e3eb5bae2054594f960
SHA512 1498287e56bba5320f396060d343cc1da59b598498041d77db0d36768e00f265f805c9fc4a60a58affbfc9aa80489757ce56246b9deb8c92de671a537c3c08df
SSDEEP 49152:J8rMjkA/nHBMz6V8XEa9R9vMjmm0BiPkWps3KxOZEW/o6s:iQjkuS6aXQOBiIsOaW/o6s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer themida

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000014251-28.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2736	cheatmoney.exe
2460	HUGK.exe

Loads dropped DLL 5 IoCs

pid	Process
2736	cheatmoney.exe
2736	cheatmoney.exe
2736	cheatmoney.exe
2460	HUGK.exe
2460	HUGK.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1640-3-0x0000000000400000-0x00000000006F7000-memory.dmp	themida
behavioral1/memory/1640-17-0x0000000000400000-0x00000000006F7000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HUGK Agent = "C:\\Windows\\SysWOW64\\28463\\HUGK.exe"	HUGK.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\AKV.exe	cheatmoney.exe
File opened for modification	C:\Windows\SysWOW64\28463	HUGK.exe
File created	C:\Windows\SysWOW64\28463\HUGK.001	cheatmoney.exe
File created	C:\Windows\SysWOW64\28463\HUGK.006	cheatmoney.exe
File created	C:\Windows\SysWOW64\28463\HUGK.007	cheatmoney.exe
File created	C:\Windows\SysWOW64\28463\HUGK.exe	cheatmoney.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\cheatmoney.exe	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1640	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2460	HUGK.exe
Token: SeIncBasePriorityPrivilege	2460	HUGK.exe
Token: SeIncBasePriorityPrivilege	2460	HUGK.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2460	HUGK.exe
2460	HUGK.exe
2460	HUGK.exe
2460	HUGK.exe
2460	HUGK.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2736	1640	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe	28
PID 1640 wrote to memory of 2736	1640	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe	28
PID 1640 wrote to memory of 2736	1640	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe	28
PID 1640 wrote to memory of 2736	1640	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe	28
PID 2736 wrote to memory of 2460	2736	cheatmoney.exe	29
PID 2736 wrote to memory of 2460	2736	cheatmoney.exe	29
PID 2736 wrote to memory of 2460	2736	cheatmoney.exe	29
PID 2736 wrote to memory of 2460	2736	cheatmoney.exe	29
PID 2460 wrote to memory of 1244	2460	HUGK.exe	32
PID 2460 wrote to memory of 1244	2460	HUGK.exe	32
PID 2460 wrote to memory of 1244	2460	HUGK.exe	32
PID 2460 wrote to memory of 1244	2460	HUGK.exe	32

C:\Users\Admin\AppData\Local\Temp\fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\cheatmoney.exe
  "C:\Windows\cheatmoney.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\28463\HUGK.exe
    "C:\Windows\system32\28463\HUGK.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\HUGK.exe > nul
      4⤵
      PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 405KB
SHA256 a79c4e0c6490d7319ab85d4d4a2bbf9e0c84a8e5af86b52c9ddb8779ffabb8fd
MD5 dc82dc0d160dbcb878f36801464f7caa
SHA1 ab2f476da88d018b7aa27f8bdd9f15405b49169a
SHA512 e3a8c85871026fdb15261da096aaac73236ceb5e6b60f091fa027565dc6f39ed4b9c27bb4b09d48aed6c5d849464e2e8540e1823e07d9bfbd77422d83125beed
SSDEEP 6144:5GY7cLhtigvSN1Jw1Xp1qiy0jstZbYad7n6JmtroMTMhOIv/5V0N7EvW:QecbvceXpQiy0ehd+UtrorAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HUGK.001

Path C:\Windows\SysWOW64\28463\HUGK.001
Size 536B
SHA256 02fc44353f2c19dfdf916360ec79d97379e1599ad8f941769cd12d0dcbb70fa6
MD5 deb0dfed8f9206d25b7baa5df5e0c474
SHA1 1b9d0e5624359ebbf55df54131d1add5d8dbb5de
SHA512 591a67b429928efe65619bcab4121249f01b290fcacc6c0a3ca24cfce9e51ac2ee9e805855be85035f6276aecbd6aab0a287f688374c647f22c0b0ef05c8119e
MD5 SHA1 SHA512

Submit Download

HUGK.006

Path C:\Windows\SysWOW64\28463\HUGK.006
Size 8KB
SHA256 fc01b2bcc8f17f707502d7fd5a14217863a1e3e00a8529c2a9e8d46f39ee1412
MD5 d06046faed6ce5b6c70786ca53cd79a6
SHA1 18a945748b4aa894487530612e6aaf20c4a5d074
SHA512 96769913e2a30ccc21deaa7803013d44ae437edee2bf9fc0532055da3c4a6c5de0bb6485da46dca00caab35a43014361713d5282e0783065f9ce5a7523012e90
SSDEEP 192:SM3mBWtCuI31JY58VINWkoHYDH7yD6p19:SZS41JY5cb4U6p
MD5 SHA1 SHA512 SSDEEP

Submit Download

HUGK.007

Path C:\Windows\SysWOW64\28463\HUGK.007
Size 5KB
SHA256 6c97872edcb4f6af14d0650f6b9f7256d0081b1d7ff77050e56fbe1d894044d2
MD5 2166b0dbd65cc3244d0a2e7695b32a40
SHA1 358e6bbd414ce534c6bf60785281928ca8abcc23
SHA512 45e51c7cd899eaa7187d7adee6bf89cf52b4c48908e72499afdfeaf5db5846614a9bfe60773abd551a8e89f718ad5d875cdff3f25f5a80ca219d49418157d6eb
SSDEEP 48:6gklbvQ+o80EE/KD4XJaKzx/aGZ1A2XBjAECi1cBaVM+kHqho0E:6gS9DMFaqhxsECiRQHqho9
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheatmoney.exe

Path C:\Windows\cheatmoney.exe
Size 493KB
SHA256 29c9ab65ec1725982dd8a3a95e87cd5d83d92b62fe9365204899350550bbcd76
MD5 114256b1982384988173a2a222e02abc
SHA1 1ed832c6e06ff35aec5d66b995e1ba302b8fc5ab
SHA512 6179044339e4be898ab9b35c088b828ddc070e5c8b223be7a334d4e4a05e472fe7f93084e85c4612b0896e49117333795fc73d97248c157606f153e0022c7e54
SSDEEP 12288:iGZ6RDg862sPOqZSB3SHNVbyPKFAvG/R9xQ:d0DgkHqzYA//NQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

@C21.tmp

Path \Users\Admin\AppData\Local\Temp\@C21.tmp
Size 4KB
SHA256 be821327fbd0d0a4b0e61f939349cfaa660a3cbcf037dd8c664a1a52372b32a5
MD5 d9cb831b02f14f8371acd33c684190fb
SHA1 5035c9ceaf35bf0c14cdc0349d1284beb0e3892b
SHA512 452d409cfd53dc8a98e7e9746d7c88e0545df024f1fe5ab81a1ecab84664b8ca7eb8d53d1c66322d49dfe74035d5e6540ad7c95b57757fe91af99bb8edab097e
SSDEEP 48:6mhtVS9tRcE2bHmIhiwNK0e+mvt55kVIPKx5M9p1GF0HIr:6+YtRmCsibWi54rU1G8s
MD5 SHA1 SHA512 SSDEEP

Submit Download

HUGK.exe

Path \Windows\SysWOW64\28463\HUGK.exe
Size 500KB
SHA256 531a5334e3132b0df427514b614075800d0cf0f4ada9da4c8a60632b53f3fd5d
MD5 a4c7f5f230b30d5e289a092bd915952c
SHA1 db42fb8d2fdf74ddbe6789a4e4a725b41e8612cf
SHA512 601475753cf9159670c544d53fbbe31fc7063cb95c905c3e1d5a9bc296482e29ff0abc3e5058f724d622c4aeaf3a35ebff75752828bd7176aae291a51713d56e
SSDEEP 6144:Qz1v4paGECo9F3y0qvbQtqCdNMLAjVJIhMqR+0/5VUNZmMcAGI:gFyaGECoRqvkqkakjVrqRsXH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1640-5-0x00000000043A0000-0x00000000043A1000-memory.dmp

Download

memory/1640-0-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/1640-3-0x0000000000400000-0x00000000006F7000-memory.dmp

Download

memory/1640-6-0x00000000043C0000-0x00000000043C1000-memory.dmp

Download

memory/1640-7-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/1640-17-0x0000000000400000-0x00000000006F7000-memory.dmp

Download

memory/1640-8-0x00000000043E0000-0x00000000043E1000-memory.dmp

Download

memory/1640-9-0x00000000043D0000-0x00000000043D1000-memory.dmp

Download

memory/1640-11-0x00000000043F0000-0x00000000043F1000-memory.dmp

Download

memory/1640-10-0x00000000043B0000-0x00000000043B1000-memory.dmp

Download

memory/1640-1-0x0000000000700000-0x00000000007E7000-memory.dmp

Download

memory/2460-43-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download