ardamax | db686549a6f0bc721fe4ea2023fd86c220f3bc3eab37870509e6650d0cd476c2

Analysis

max time kernel
141s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe
Size 527KB
Sample240706-gnk29szfqa
SHA256 db686549a6f0bc721fe4ea2023fd86c220f3bc3eab37870509e6650d0cd476c2
MD5 2777e8235675d1f95056335d29e60a34
SHA1 c56f898e76917aafb7c11a4a721d15af0a15f07e
SHA512 0e81cb99606171a56e25fce8349f7f5696684062a8b26048d4bbbde31adae4d5c8135260a6f5621e581d61e5372fbdd20c0321f7a60ae8c05ee5882f38803263
SSDEEP 12288:BRUCC4WxjxdQ3BnvlO4xB+kgeBxxdpvyEzkgo98LGbZ8gO:QcW5Q31vlR+kg4xxdQ398LGV8gO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax aspackv2 discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023486-12.dat	family_ardamax

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000023488-26.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Control Panel\International\Geo\Nation	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3560	WNNN.exe
3224	Agbot.exe

Loads dropped DLL 7 IoCs

pid	Process
1324	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe
3560	WNNN.exe
3224	Agbot.exe
3560	WNNN.exe
3560	WNNN.exe
3224	Agbot.exe
3224	Agbot.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WNNN Agent = "C:\\Windows\\SysWOW64\\28463\\WNNN.exe"	WNNN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\AKV.exe	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\28463	WNNN.exe
File created	C:\Windows\SysWOW64\28463\WNNN.001	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\WNNN.006	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\WNNN.007	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\WNNN.exe	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3560	WNNN.exe
Token: SeIncBasePriorityPrivilege	3560	WNNN.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3224	Agbot.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3224	Agbot.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3560	WNNN.exe
3560	WNNN.exe
3560	WNNN.exe
3560	WNNN.exe
3560	WNNN.exe
3224	Agbot.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 3560	1324	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe	85
PID 1324 wrote to memory of 3560	1324	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe	85
PID 1324 wrote to memory of 3560	1324	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe	85
PID 1324 wrote to memory of 3224	1324	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe	86
PID 1324 wrote to memory of 3224	1324	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe	86
PID 1324 wrote to memory of 3224	1324	2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2777e8235675d1f95056335d29e60a34_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\28463\WNNN.exe
  "C:\Windows\system32\28463\WNNN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3560
- C:\Users\Admin\AppData\Local\Temp\Agbot.exe
  "C:\Users\Admin\AppData\Local\Temp\Agbot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@AD57.tmp

Path C:\Users\Admin\AppData\Local\Temp\@AD57.tmp
Size 4KB
SHA256 a49cb9cbab2a60418b2079d4110123682fc980bb6b46ac5ada144797b5fa2cf4
MD5 9dc64557fcebd521ca4b267da15c2914
SHA1 c2247f9e0f0c8d11c7b9ab93f43ed53943d0bdd2
SHA512 00241a139ca307c5eb4d89fa8b6296833961091286282c3482746e4a3589ef61e6d007edb6aa6fa1ef812d57bf63a8e495e0db712e17decc77bbae2490cdbe01
MD5 SHA1 SHA512

Submit Download

Agbot.exe

Path C:\Users\Admin\AppData\Local\Temp\Agbot.exe
Size 30KB
SHA256 df360deca85cb86e6aef88c9472397ac96317b67151e219e940d09a4026c5072
MD5 e3b337848a3c627279cc071b075b85ac
SHA1 7d46fced11b78ec1a07442dd141a25c087ab60e5
SHA512 954a96d3cfd503230ca1dc2eebd8e5ca3b439000a310d938ce4648adacdb80ed8ab254e77e4456abc46e9b73d94edcdef4e33e70f54ee2886883db4366cbea48
SSDEEP 768:CBqO6Qu8b3Xt4yFAp3qS9lQ06Wawv3GHxfdeVrK0j:CEurH+aD06XwPmeK0j
MD5 SHA1 SHA512 SSDEEP

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 394KB
SHA256 e91b458384ad38f5e81766bc7ae213025f27f30c69b72550731159aa60d62910
MD5 10e53b4b4502bab5358837983b15d83e
SHA1 2845bb0d6667be127bab7676b6800994239850ce
SHA512 35b2071598af5840ed0843e39f81b778660310725975c2b2cc8cd20ad37954bea04c4a2f173cdaffa467e9585b7f573b99fd444f659d11360bd7a8219c851cd7
SSDEEP 6144:yThnH+GwLUj2Lqfh76KZscwbSGsO6FPgUVuEOP/GVyNzDBm:aHVwLzqfh76GS+GKBgUd3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WNNN.001

Path C:\Windows\SysWOW64\28463\WNNN.001
Size 456B
SHA256 22a58809cdf7d86c1a215ff6673748380205d5ee80480473a93a3551ace4faf4
MD5 c434f0b948bcbed1517aebaf19ea8a29
SHA1 87b563acc841d75f59966e910d71f3df366bc48c
SHA512 4bd0200bb9d3cefdf50f1ea180d16643dceca8f14b54dd20f68741436f806f0eeecf7b7aa7bb05a0f6089b2e35d7a9955b39b521be8294e5d494b7f5ee165275
MD5 SHA1 SHA512

Submit Download

WNNN.006

Path C:\Windows\SysWOW64\28463\WNNN.006
Size 8KB
SHA256 b796bd1f5cdb1d1db91c3aca1ac700c015775b9caf2725fbf4b6089a096f21c5
MD5 86d96c93965255cef35ca42413188b75
SHA1 9d77f203267febe047d049584e5c79f1c1801b2d
SHA512 2db81080a16494ec549f4f39ee382580ba12cd5cbfe31632c8459ba94d767ce1ad3e9c0e6643f80530ae5e316fc42dca05708eeade7ce3c0341d669325cdb095
SSDEEP 96:6Mzh3GtHUedZQ3XQHI8QP/KYTJ+cwXofW1KWCj0+MRZQEUyHe1e2mIXT6pD3Ap:x3G5UjAHInP/KYF05CqRZP7oeyD6pc
MD5 SHA1 SHA512 SSDEEP

Submit Download

WNNN.007

Path C:\Windows\SysWOW64\28463\WNNN.007
Size 5KB
SHA256 4ba88f8964ee02a395d88974fd43b05610cf520b4ab40f36b3f98715ce1e0984
MD5 b73942c11844487ca7fc3e78062c8abb
SHA1 28f4c4159528ccbe9d83b5cd5e157861d11ff04c
SHA512 d4c782f5abd91b3396b243345f968eb5a705a7aefeedf92e62047309f7ccf223c0825623c184de66e3667c22eb371f0329be97ea70f6d72b54f98b22042e1f9c
SSDEEP 48:6gklbxQo80EE/KD4XJ2zxN03Uzdy2X3VIECi1cBaVM+kHXs:6gS0DMm03abnKECiRQHXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

WNNN.exe

Path C:\Windows\SysWOW64\28463\WNNN.exe
Size 472KB
SHA256 ded1c934280294375d7b926773511e4d5e6c8dbb22b0dd25a80a6b0b3af065d3
MD5 324154483b20e6f67a3c1486e3fc7c6a
SHA1 d6630eb1d8555b48413434b4a5d54c8de819cbf8
SHA512 36349f7c53b9989eac63e8c91b7fb009a5a0dce934242ae5956a5e3d3764949a87296adeba81f3da96b5e035f3755b4dd75de2ffa211b7db296313c52f6d478b
SSDEEP 6144:2BIhglmCAIoqDeLEQhb98+iyvqUFIraPQbCV/cVxNFqQwBUXAb:+l6jEQhIqqUFINWbZb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3224-34-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3224-44-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3560-23-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/3560-46-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads