ardamax | 584c6f23feab2cdf60959d3ea3342dbb4320bb59e03fc24ef151a77c61efb6de

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe
Size

3.9MB
MD5

2b7fbf51557068f876b88bf75b2206d0
SHA1

46bef2b5ad35495d5b18c96949fa9d24b2d53c25
SHA256

584c6f23feab2cdf60959d3ea3342dbb4320bb59e03fc24ef151a77c61efb6de
SHA512

2cd4f8e96babe15820cb3ba626e271bacd0f27c3196fc505225081756dec632a0e3fb4fc622d729f71e6475ad52cf7cf83477374e2c480f9e4ab4c356faac1be
SSDEEP

98304:i6PSacL7Jn1POYF40luqiwz3I6OJFzAqa90hX3re80:iwHc/Jn1pFdiwbI6OJ090xe8

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000175f2-9.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
1364	VLK.exe
2800	ccsetup302.exe

Loads dropped DLL 12 IoCs

pid	Process
2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe
2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe
1364	VLK.exe
2800	ccsetup302.exe
2800	ccsetup302.exe
2800	ccsetup302.exe
2800	ccsetup302.exe
2800	ccsetup302.exe
2800	ccsetup302.exe
2800	ccsetup302.exe
2800	ccsetup302.exe
2800	ccsetup302.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VLK Start = "C:\\Windows\\SysWOW64\\NBNVSV\\VLK.exe"	VLK.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NBNVSV\VLK.001	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NBNVSV\VLK.002	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NBNVSV\AKV.exe	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NBNVSV\VLK.exe	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NBNVSV\	VLK.exe
File created	C:\Windows\SysWOW64\NBNVSV\VLK.004	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0032000000018675-18.dat	nsis_installer_1
behavioral1/files/0x0032000000018675-18.dat	nsis_installer_2

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	ccsetup302.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1364	VLK.exe
Token: SeIncBasePriorityPrivilege	1364	VLK.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1364	VLK.exe
1364	VLK.exe
1364	VLK.exe
1364	VLK.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1364	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1364	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1364	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	30
PID 2136 wrote to memory of 1364	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	30
PID 2136 wrote to memory of 2800	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	31
PID 2136 wrote to memory of 2800	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	31
PID 2136 wrote to memory of 2800	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	31
PID 2136 wrote to memory of 2800	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	31
PID 2136 wrote to memory of 2800	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	31
PID 2136 wrote to memory of 2800	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	31
PID 2136 wrote to memory of 2800	2136	2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b7fbf51557068f876b88bf75b2206d0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\NBNVSV\VLK.exe
  "C:\Windows\system32\NBNVSV\VLK.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1364
- C:\Users\Admin\AppData\Local\Temp\ccsetup302.exe
  "C:\Users\Admin\AppData\Local\Temp\ccsetup302.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\NBNVSV\AKV.exe

Filesize
456KB

MD5
1f29b1075a91b3da0ccc0b9c49eece56

SHA1
048e675f087181035aedece9e7b11d065c6355cc

SHA256
4f6825548b32329c3360ed9abb7c0a6809a2c2291cf0bcaac511a9fa32a6336e

SHA512
7e152caf055f57f599ecc1e3a404b540b721b3315d2ba16bff6eb21f03edeb3a06ae185621e3139293612d94210f500f098bd281489ca7f336efd8b5284ee060

Download Submit
C:\Windows\SysWOW64\NBNVSV\VLK.001

Filesize
61KB

MD5
31c866d8e4448c28ae63660a0521cd92

SHA1
0e4dcb44e3c8589688b8eacdd8cc463a920baab9

SHA256
dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1

SHA512
1076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839

Download Submit
C:\Windows\SysWOW64\NBNVSV\VLK.002

Filesize
43KB

MD5
093e599a1281e943ce1592f61d9591af

SHA1
6896810fe9b7efe4f5ae68bf280fec637e97adf5

SHA256
1ac0964d97b02204f4d4ae79cd5244342f1a1798f5846e9dd7f3448d4177a009

SHA512
64cb58fbf6295d15d9ee6a8a7a325e7673af7ee02e4ece8da5a95257f666566a425b348b802b78ac82e7868ba7923f85255c2c31e548618afa9706c1f88d34dc

Download Submit
C:\Windows\SysWOW64\NBNVSV\VLK.004

Filesize
1KB

MD5
f61916867a1b102108331001e233e16a

SHA1
3a3060c9acb5ea48c0957486a9a5fb751a098d88

SHA256
db5e1e814a3239c9ffcb3ac419e6853d1bd25f318ee1c00bcec713863e0b6fec

SHA512
66fc26af3829075d752f9e6061befe738ec2cb2d3a07d86df91509516346e4a4be509fbdaa31f126308ae06cfd1544d8ef6b1c48084ef98b8229942215108010

Download Submit
C:\Windows\SysWOW64\NBNVSV\VLK.exe

Filesize
1.5MB

MD5
0aaffc12ef1b416b9276bdc3fdec9dff

SHA1
9f38d7cf6241d867da58f89db9ff26544314b938

SHA256
42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b

SHA512
bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c

Download Submit
\Users\Admin\AppData\Local\Temp\ccsetup302.exe

Filesize
2.8MB

MD5
8142275100b3de92db382a0deb3a24d5

SHA1
b5346480c86bcd3e1521bdf50c30aebb441a8f6d

SHA256
ccfdc462286758b75f118115f466daa59e9bea56324cc50e72e77928783f5add

SHA512
5b6af7cd697b1416c7c21d25bffacd0e41a67cec5aa54f55c30cbaadebfd47abb9d9c281750a9f5ee3994b3897790c56bc8264419f6124fd4228df861f063317

Download Submit
\Users\Admin\AppData\Local\Temp\nseACF4.tmp\ButtonEvent.dll

Filesize
4KB

MD5
fad9d09fc0267e8513b8628e767b2604

SHA1
bea76a7621c07b30ed90bedef4d608a5b9e15300

SHA256
5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

SHA512
b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

Download Submit
\Users\Admin\AppData\Local\Temp\nseACF4.tmp\LangDLL.dll

Filesize
5KB

MD5
9384f4007c492d4fa040924f31c00166

SHA1
aba37faef30d7c445584c688a0b5638f5db31c7b

SHA256
60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

SHA512
68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

Download Submit
\Users\Admin\AppData\Local\Temp\nseACF4.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nseACF4.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nseACF4.tmp\g\gcapi_dll.dll

Filesize
62KB

MD5
f6400e8bdca118c6b5170c172fcbc06e

SHA1
992d2d0ee1f1621dd6fc0452d26ffcb65c30a95f

SHA256
c66dedc708c1ff94b16c46951570887f528e542bbb3e5574ba314fbb736a9cb4

SHA512
15fb3eb080e91284709d759b9b051051f64f47850b2a108d7c8f9b334237a630573c5c96eaee2a70b635ce74eabeb46c53178f1986e985819140d8fe88b3f143

Download Submit
\Users\Admin\AppData\Local\Temp\nseACF4.tmp\g\gtapi_signed.dll

Filesize
71KB

MD5
61bc40d1fad9e0faa9a07219b90ba0e4

SHA1
5b5c3badedba915707000d2047eaf13f27b8925e

SHA256
89e157a4f61d7d18180cb7f901c0095da3b7a5cc5a9fd58d710099e5f0ee505a

SHA512
fa341aa975c471082b4b6c380f794d1e9ab3939382972cfb9e1dbb3491f68296ad1cedc8f03736921c8e133f62432997de29642e223c2a97f1cab5ce91d68af9

Download Submit
\Users\Admin\AppData\Local\Temp\nseACF4.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/1364-17-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1364-72-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2800-34-0x0000000000830000-0x0000000000845000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads