ardamax | db794f98e50ed2e3e0e3b892fe10ef52aa78aebe97948c7290937c5bf7b0b168

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
Size

3.0MB
MD5

2ac12a75635d3881e97c04fb8630e35c
SHA1

b9a0601166d64559e89cf599e4275f19544e62c7
SHA256

db794f98e50ed2e3e0e3b892fe10ef52aa78aebe97948c7290937c5bf7b0b168
SHA512

73f4cf2036ee718cafc0d6907fb537efc4ca029adb0f6ba643645ad4d2d3bc8f9d10eec053ea09b407b4dceacb44e5bfc5550f79a86768f39eede56161482115
SSDEEP

49152:UoT4BEOjANQ1kvYNjP3Jst/8VxZtDFGFPbIy+RLmI5Mm6hyASvIzylDGekHNCI9h:EDZst/+L7G6yXm6hyASg+wHNvNfd

Score

10^/10

ardamax discovery keylogger persistence stealer upx

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000014216-7.dat	family_ardamax

Executes dropped EXE 3 IoCs

pid	Process
2664	PGG.exe
2812	teamviewer_setup.exe
2400	TeamViewer_.exe

Loads dropped DLL 19 IoCs

pid	Process
2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
2664	PGG.exe
2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
2812	teamviewer_setup.exe
2812	teamviewer_setup.exe
2812	teamviewer_setup.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe
2400	TeamViewer_.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000014983-21.dat	upx
behavioral1/memory/2240-24-0x0000000000A80000-0x0000000000ABA000-memory.dmp	upx
behavioral1/memory/2812-29-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/files/0x0006000000014c25-34.dat	upx
behavioral1/memory/2812-37-0x0000000002270000-0x00000000022B5000-memory.dmp	upx
behavioral1/memory/2812-42-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral1/memory/2400-277-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PGG Start = "C:\\Windows\\SysWOW64\\YKESJY\\PGG.exe"	PGG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\YKESJY\PGG.exe	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\YKESJY\	PGG.exe
File created	C:\Windows\SysWOW64\YKESJY\PGG.004	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\YKESJY\PGG.001	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\YKESJY\PGG.002	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\YKESJY\AKV.exe	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\YKESJY\PGG.003	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2400	TeamViewer_.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2664	PGG.exe
Token: SeIncBasePriorityPrivilege	2664	PGG.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2664	PGG.exe
2664	PGG.exe
2664	PGG.exe
2664	PGG.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2664	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2664	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2664	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2664	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2812	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2812	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2812	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2812	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2812	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2812	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2812	2240	2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe	29
PID 2812 wrote to memory of 2400	2812	teamviewer_setup.exe	30
PID 2812 wrote to memory of 2400	2812	teamviewer_setup.exe	30
PID 2812 wrote to memory of 2400	2812	teamviewer_setup.exe	30
PID 2812 wrote to memory of 2400	2812	teamviewer_setup.exe	30
PID 2812 wrote to memory of 2400	2812	teamviewer_setup.exe	30
PID 2812 wrote to memory of 2400	2812	teamviewer_setup.exe	30
PID 2812 wrote to memory of 2400	2812	teamviewer_setup.exe	30

C:\Users\Admin\AppData\Local\Temp\2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2ac12a75635d3881e97c04fb8630e35c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\YKESJY\PGG.exe
  "C:\Windows\system32\YKESJY\PGG.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\teamviewer_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\teamviewer_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Users\Admin\temp\TeamViewer\Version4\TeamViewer_.exe
    "C:\Users\Admin\temp\TeamViewer\Version4\TeamViewer_.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy1354.tmp\environment.ini

Filesize
661B

MD5
d49491c7ba7bd565e1b8ff473cd84c8e

SHA1
2522272cf01af17f8ace15a29759f7629ebdc94e

SHA256
0be1c22c6f540d98cd55d7f434f57aedffc67a19df4e4957f75eb034a7b3d9bb

SHA512
2207da44794bd8b8ed1161a0a1990d13824c91b651711d20fbd14769f898a95168884e217f24465b309901215961f3bcb287214b61c5ce2fbc020e8e21cb7b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy1354.tmp\host.ini

Filesize
975B

MD5
69a491a30f8fd22d3210847d54274a19

SHA1
7e19eb2b1424bb487708f91001d0a001e214ebb8

SHA256
49a8ab22496032d8286c7fa71d1e5fc3f13079572d45e4140d1b24be57202b53

SHA512
4ac8b38c91eb466cc31e8256cd7a59bf10ff088a3ff233510277be969134c7da2c784fb1254323c2a3e502d2daa98561c160d321a153914b65f97c6bec79207b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy1354.tmp\start.ini

Filesize
1005B

MD5
cd2f19f895e9bd53540d2a5165a561ae

SHA1
ce80d3d9faceb3423a3432ccb8d1f961b21d0a5d

SHA256
8fa729f1a5db75f576e55c09a4fac4e73c849e20fee3c702a88f12efdefb5675

SHA512
70da7d1733dd03b6f453a0434b4b00bb786941f5d9ce872be395c5b1f7cd0c7b41ecaa8cc7d827d2448571e3b6671b0b363e49fccb474b8bf25236cfacdb0f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy1354.tmp\start.ini

Filesize
983B

MD5
1b0d350e8552248d67c2d8c9ed55a6d2

SHA1
343a5028330631315b69f059d24dbd4a0905c32f

SHA256
37e93908ae8adb3d8af00b8d5a42bc69ee881a97493adc58b8bd83ea125ab09b

SHA512
0478e62460afcfdbc68aa2bd5a514b2d483e2e10bc6644d58597cc524b86b669c1701271dcc7c7279ce14aa9121bc91c94570ac92c26ebcc9f29301bf57f73aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy1354.tmp\start.ini

Filesize
1KB

MD5
db164fe32f256c05b3d50621a5c2082d

SHA1
08ed8aa23043498c6ba60623b54c3db191b6dfaf

SHA256
4eed5276bf09419a87e942f095c762c274df49b7641e956d14ac56127f736ea9

SHA512
3a419fdbcbeb937e40fdfc04f609e59884319f4faaf7c363f1308d6f282c840005ec1a2f975ef71a16b02d14bc396eb535fd0e64bf9dabdd391cc3058393f97e

Download Submit
C:\Windows\SysWOW64\YKESJY\AKV.exe

Filesize
463KB

MD5
eb916da4abe4ff314662089013c8f832

SHA1
1e7e611cc6922a2851bcf135806ab51cdb499efa

SHA256
96af80e7ba0f3997d59ebcb5ecef619f980d71ca29113e2cd2f2e8adcdea3061

SHA512
d0dbe1d1612982b9cd2a3ed3cbd3e3b5be49237f580f91d5e5d5b6d20ed4dc0babb69a666c19bf4e0f10776a43b9b1dcda91a4cd381ce3705b1795ef9d731c8b

Download Submit
C:\Windows\SysWOW64\YKESJY\PGG.001

Filesize
61KB

MD5
425ff37c76030ca0eb60321eedd4afdd

SHA1
7dde5e9ce5c4057d3db149f323fa43ed29d90e09

SHA256
70b00b09ae76a7ecfd6680ab22df546b17826755087c069fc87d14895e1a4e24

SHA512
ef5ff97c0d682b6155eff8f92dace1789cf01ca8bca55af1c1d0f2243b5e18bc12a657bb2bb12601b51ef9e1b942f02feb8462644da291fd1b2239c34ef2b59b

Download Submit
C:\Windows\SysWOW64\YKESJY\PGG.002

Filesize
43KB

MD5
12fb4f589942682a478b7c7881dfcba2

SHA1
a3d490c6cda965708a1ff6a0dc4e88037e0d6336

SHA256
4de0c277800ae36b85a11ed9765f732a73578d4dce053ff7179f96ab776fb60d

SHA512
dd1c6a4ea5bc9698701ec941c4e90fe8dfb0993dc321edc052d1a80cc49bc46be665a85ec678876e698de60cda5dbf1d6279742a16d648f9d18e642a3ea33ddd

Download Submit
C:\Windows\SysWOW64\YKESJY\PGG.003

Filesize
68KB

MD5
f47e8f65618e1b1f7e1720713f5a8c4c

SHA1
abad8e9e13b1e41f2af86e3c16526c6f2d05d952

SHA256
f170be2582c82ea131e1f688eea6e1cd17d14e6a9bb805b6aed2791e625a74d8

SHA512
635d617dbd15d00e2f7470857531b9820439a8816f2c74b3d83156599537ff42e26ea7d769863f2768eb2770ba9c47b1a10eb3e2677fe92b9eda6ae51da18dcb

Download Submit
C:\Windows\SysWOW64\YKESJY\PGG.004

Filesize
1KB

MD5
14498ea6c94768c0312a6d2107335783

SHA1
6197dcd7ee76f46f8a2038a0435534d2ce0ec774

SHA256
ec2b3a557d9b76e651078616336a9bf99067b7c4eeed07280d193ca9bfc19807

SHA512
dfa0a63b9c8799fbe9fe3738b8cf9fcb0788e2488f9a6203145ba0877d133391dd6f1071731ad5201fc2f36572ba940beb74f7893679897c2e6c5911f9427249

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1354.tmp\InstallOptions.dll

Filesize
14KB

MD5
7af3ead73bedf48083d088228d99b200

SHA1
66123f71a8303951517748317a6a475e1154a7c7

SHA256
75ff58404f0211a16341aee2eeeb5c19afc8d7827a79b27c5aa501f53a0bad71

SHA512
9635319adb84555568356a63b7608fb1e7df74625d56ad1d43caa3048ef0cd8c39919c87d8ecf3841a7c770a7f2c5895239140969a23aeb7720fd03f402693b4

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1354.tmp\System.dll

Filesize
10KB

MD5
0b96e50e5fd9b241435cfec46600b5a7

SHA1
1f79688c6bdd78b4e1812b110fd16d27c59b32d5

SHA256
10841d8d0a0fa457a62be63af7e30e72ffaec265470dbe16c0d61cc5b111d1e6

SHA512
01a5884ce81a622f81da23c4075aef4cbe68d18471908bb6082ad98bfd002c8a6c2b8069d250df0320cde22ad76eedc14a5d9369b370c2012d58575720da48b7

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1354.tmp\TvGetVersion.dll

Filesize
6KB

MD5
409b195108f014b032eb5dd36ca17a12

SHA1
4544950c7c081fb0aeba7971bcf46f2761430f4e

SHA256
52b487ff38814953eae017f2751f8e2fed7284f6faa250266cbd8d749547695f

SHA512
fe981570f6642933c36bbd7b1fef0d7e469600d44ea9e3b94ad94e1b6bb81c98c74c0d1c8673385443daaa3750de4e7eedc49aaf38ccc56c09e2d141e27068db

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1354.tmp\UAC.dll

Filesize
15KB

MD5
f6864bd1708daa67dc0e47d5624e8938

SHA1
dfbb5a96f13ab36712349d7c56e2e7fc9ab73819

SHA256
2bc962a7f596a0c0a40bf3c3dfcf77c4e8dfc49830115e636b720ab68094606b

SHA512
d935fb87b2ed6e668e80627f21d965df7b73dfbf47c33e02721f02cbab2c525c0f5a36eb2a84573af2fffe5db43ac8823079607b9b70bb2bf51b0df8195ff01b

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1354.tmp\UserInfo.dll

Filesize
4KB

MD5
fcad39646b416b4c2e0ea259554c3ec1

SHA1
8cb881913d923de35e6e131c2329b20ce51fe84f

SHA256
bc3872dbafefc41db2191b11b7371e988736dc12c9913bead1aa953dd28ef62b

SHA512
d81e00ac4828cce4ada42d28845d91601a98a6647d7b4fabad23e45b1aa529297fc554771b8cf8e484525e91a58f892ba5836263a81d6c061a54801abf0beecf

Download Submit
\Users\Admin\AppData\Local\Temp\teamviewer_setup.exe

Filesize
1.9MB

MD5
13d257b6db15707dbcb2183da3dd80aa

SHA1
120cf548e144074e7b7e5e3880f03e2887d03dc6

SHA256
ad9fa4b606f56c5f68e32c8e42405cb41251ba2448b8664f907a52be475188d6

SHA512
699e9815526a605beab9f63dd7151acb74971e128a113e88807360135a3d9880f0d778c6357ba61895b11de5ce79d0dd6695ac7c8c1ca2f06d62e48305015dca

Download Submit
\Users\Admin\temp\TeamViewer\Version4\TeamViewer_.exe

Filesize
1.8MB

MD5
0b61c488862a805b1a544585a479fb01

SHA1
4f4e175ca7b8952896d374588f40d2b3e39ae945

SHA256
b95e277ffa4d4057840616f31a27a781e5d14cabfc0c2a8611cfa2d22937a59a

SHA512
4ea1d5dbcd9e4242ff589d849158ca4ea8eca83eb093e7e1dc6e2e3816461208b942d7c05a6d27c52467bc69a5d5a701b223780f17dc2949c71e4e17a853b24c

Download Submit
\Windows\SysWOW64\YKESJY\PGG.exe

Filesize
1.5MB

MD5
f8530f0dfe90c7c1e20239b0a7643041

SHA1
3e0208ab84b8444a69c8d62ad0b81c4186395802

SHA256
734439c4049ae1a832b4cc5c8d227112106406945d1a7cbb355e11a3f5e356c4

SHA512
5cb01517938789e006e00d69729ae7d73ad480f1ae17a80059bf81ee5d9cebb1263a35732c84f03d742684a650b116b13e6731ca80b0b9cdb3908e5588649399

Download Submit
memory/2240-24-0x0000000000A80000-0x0000000000ABA000-memory.dmp

Filesize
232KB

Download
memory/2400-277-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2664-19-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/2664-276-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/2812-42-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2812-37-0x0000000002270000-0x00000000022B5000-memory.dmp

Filesize
276KB

Download
memory/2812-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads