ardamax | 95053ff336290f30f1b26b974cbc567711c1d647e96fbb989e62b6230b9481d8

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
Size 6.7MB
Sample240627-22cchazamn
SHA256 95053ff336290f30f1b26b974cbc567711c1d647e96fbb989e62b6230b9481d8
MD5 17ddf2ebc8a2c90039757eb88a160e48
SHA1 08ae89e1428e569042a284b52aafaab16e116c43
SHA512 d4be93e43dd02e179e09399add919f623d5aeda6e89556741828ee3e892f9e45eb668551dceae8285bdf3517b86eb2c8c0cc2da7798955a7e60d361df830deb4
SSDEEP 196608:x+TwuskzQ5IAFMhZF2JW7V1796MS6XJq9mJE2pVK++U/z:xAwusJ5IAFof2UXQ6XsmNpT1/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016310-8.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2264	IGV.exe
2648	UNLOOCK.exe

Loads dropped DLL 5 IoCs

pid	Process
2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
2264	IGV.exe
2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
2648	UNLOOCK.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IGV Start = "C:\\Windows\\SysWOW64\\VWGBPJ\\IGV.exe"	IGV.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\VWGBPJ\IGV.003	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VWGBPJ\IGV.exe	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\VWGBPJ\	IGV.exe
File created	C:\Windows\SysWOW64\VWGBPJ\IGV.004	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VWGBPJ\IGV.001	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VWGBPJ\IGV.002	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VWGBPJ\AKV.exe	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VWGBPJ\IGV.chm	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2264	IGV.exe
Token: SeIncBasePriorityPrivilege	2264	IGV.exe
Token: SeIncBasePriorityPrivilege	2264	IGV.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2264	IGV.exe
2264	IGV.exe
2264	IGV.exe
2264	IGV.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2264	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2264	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2264	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2264	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	28
PID 2236 wrote to memory of 2648	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	29
PID 2236 wrote to memory of 2648	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	29
PID 2236 wrote to memory of 2648	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	29
PID 2236 wrote to memory of 2648	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	29
PID 2236 wrote to memory of 2648	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	29
PID 2236 wrote to memory of 2648	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	29
PID 2236 wrote to memory of 2648	2236	17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe	29
PID 2264 wrote to memory of 1568	2264	IGV.exe	32
PID 2264 wrote to memory of 1568	2264	IGV.exe	32
PID 2264 wrote to memory of 1568	2264	IGV.exe	32
PID 2264 wrote to memory of 1568	2264	IGV.exe	32

C:\Users\Admin\AppData\Local\Temp\17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17ddf2ebc8a2c90039757eb88a160e48_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\VWGBPJ\IGV.exe
  "C:\Windows\system32\VWGBPJ\IGV.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\VWGBPJ\IGV.exe > nul
    3⤵
    PID:1568
- C:\Users\Admin\AppData\Local\Temp\UNLOOCK.exe
  "C:\Users\Admin\AppData\Local\Temp\UNLOOCK.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\VWGBPJ\AKV.exe
Size 456KB
SHA256 4f6825548b32329c3360ed9abb7c0a6809a2c2291cf0bcaac511a9fa32a6336e
MD5 1f29b1075a91b3da0ccc0b9c49eece56
SHA1 048e675f087181035aedece9e7b11d065c6355cc
SHA512 7e152caf055f57f599ecc1e3a404b540b721b3315d2ba16bff6eb21f03edeb3a06ae185621e3139293612d94210f500f098bd281489ca7f336efd8b5284ee060
SSDEEP 6144:90B40/LoK9iOpVwcLxMkpTQwEep1xAqSkv9K4/6VDM0nam41lqV+k1t:OBz/EopVwcFMqQ5OKlkv94V+kP
MD5 SHA1 SHA512 SSDEEP

Submit Download

IGV.001

Path C:\Windows\SysWOW64\VWGBPJ\IGV.001
Size 61KB
SHA256 dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1
MD5 31c866d8e4448c28ae63660a0521cd92
SHA1 0e4dcb44e3c8589688b8eacdd8cc463a920baab9
SHA512 1076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839
SSDEEP 768:Fo9fmwR3lyicJ7EYI4RLzpZbX2LEdTTESWkPvzckKlrJFiIn45DfJtDa:2hrcPIaF1X24JakPvzup2b5DB
MD5 SHA1 SHA512 SSDEEP

Submit Download

IGV.002

Path C:\Windows\SysWOW64\VWGBPJ\IGV.002
Size 43KB
SHA256 1ac0964d97b02204f4d4ae79cd5244342f1a1798f5846e9dd7f3448d4177a009
MD5 093e599a1281e943ce1592f61d9591af
SHA1 6896810fe9b7efe4f5ae68bf280fec637e97adf5
SHA512 64cb58fbf6295d15d9ee6a8a7a325e7673af7ee02e4ece8da5a95257f666566a425b348b802b78ac82e7868ba7923f85255c2c31e548618afa9706c1f88d34dc
SSDEEP 768:tJzRGjVrli1HP6qsPH7dR0wvwjoe01yym3wMRz8J:tJmAHwPH7dR0jIN8Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

IGV.003

Path C:\Windows\SysWOW64\VWGBPJ\IGV.003
Size 68KB
SHA256 0e9ad560a655389505223a02839368ed7a85deb0b9b19a3d0885a05f372d6811
MD5 e62282afbb1c9f894927a0342f66e071
SHA1 1ab7481a0e770d92ac8ef50b56efa9730ce31a22
SHA512 d5c44ab9f014c816be109e508e16eed753e47691df3f87980eafcc3b698ce11f6aff2650a526837d54312a26fe88dfdfc88d33c9bf4044971b654e8be250ff78
SSDEEP 1536:j5weLoZs1Hfmuu8IvLKijIO7nToIfmFRAkV:1HLoscZLKiFbTBfmFRAkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

IGV.004

Path C:\Windows\SysWOW64\VWGBPJ\IGV.004
Size 1KB
SHA256 7b0dd36933b0621c89eece29f632cda618a564d3c8d02dbccd2b4f53b63aa387
MD5 74c1aa0508c3a034ac850b7ed0aadc10
SHA1 5042d5d48100c999ed015676e1fdeca9b4989c7d
SHA512 f4806b81651971c09a9253c43d780335e2dc09a6185fc85a20c721d3dbd6d1379b3cf0507f7dcebf5ba4d979669105f2359fafdeca0e1d38fe574f2da72bc39e
MD5 SHA1 SHA512

Submit Download

IGV.chm

Path C:\Windows\SysWOW64\VWGBPJ\IGV.chm
Size 20KB
SHA256 c69e694d6db9a958a99901afb86a8b864a17b510a5dcdd1c176f53abf0c61a61
MD5 164ea98e2f64635f8a097870781da36c
SHA1 7cd9294657902f6bc199007e30f6514fce66f666
SHA512 4e19842a0d959876cdac60fd145fa36f2d98650b843c6faea2b01e205b2f0ce262b45c1c60fbf483320f012d4c00b96dff36e72d27ecbe9133f09d6618cbde20
SSDEEP 192:7sqtv2bhs5issT4cU8hkycYmP1twbf9q4CtN1sLacE+NfNfQo7UWf4oXt3YTu9ZP:75lVis3F8uhYswbw7NuNfNX7fRp9R
MD5 SHA1 SHA512 SSDEEP

Submit Download

UNLOOCK.exe

Path \Users\Admin\AppData\Local\Temp\UNLOOCK.exe
Size 5.7MB
SHA256 5036557640f548acdf7a42890f32063fbb724b31020f49325f44b0cefe992eb8
MD5 2b47577b7af16653f93ec2a3b9dcebc7
SHA1 0118e14d3b777d2948fce4f5b6f6adfe8cd65367
SHA512 3dd3afd368436cb07bb2a188ddd0a963f144412a9cbe14c99df792f19856f3991096b298333725d40411a3634cf7d295fef396122f7aea11c2b9f142f43beb27
SSDEEP 98304:7ndv+NQTGdYRcDaG6lphUwOiec/zhY+/JfdMPhJthQB6ZzChmBbWNROj3FamhleZ:wNQTG4aupha0/zj/JfythQ68k5kROUae
MD5 SHA1 SHA512 SSDEEP

Submit Download

IGV.exe

Path \Windows\SysWOW64\VWGBPJ\IGV.exe
Size 1.5MB
SHA256 42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b
MD5 0aaffc12ef1b416b9276bdc3fdec9dff
SHA1 9f38d7cf6241d867da58f89db9ff26544314b938
SHA512 bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c
SSDEEP 24576:8HcNCtrnCeZK8FUnIHh1q6DHxSPqVSCoTxAnKJxdBTrRpOZl3Z2sfvYBarT:8HcNCtrnCkHHhw67U5HNAnOT1pOZtZ2g
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2264-21-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2648-41-0x0000000000400000-0x0000000000425000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads