ardamax | aeae5d2ac39cc5f21e360b31a9185f9633321d13a57c3da8768db40be55855ea

Resubmissions

22/07/2024, 17:36

240722-v621dszbmk 10

22/07/2024, 17:30

240722-v3l5rsydpa 10

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe
Size

1.2MB
MD5

641cd74ae74576b277820fea5bdb9aec
SHA1

e78a0b0310d7a4bf7fb550ccf436ec9bf9b1c0a1
SHA256

aeae5d2ac39cc5f21e360b31a9185f9633321d13a57c3da8768db40be55855ea
SHA512

ec99f2e7800bbdd779303bf94eb4f3a9976484e7ebac6ebe91b78859d4f0951e7d5e99af5e354ce5fb41325272e064f8bc2161c7e267dfd8a4bf4607d720b5b1
SSDEEP

24576:7uNOTWMB/bNvL6Cj64QdGyW+ztvRa/y7GenwMvkb02r8rON0gn8k8NTV5nj:7ucTWqLFr9AtJqnenwMk02r8rON94

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000001631e-6.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2368	SNC.exe

Loads dropped DLL 2 IoCs

pid	Process
2968	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe
2368	SNC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SNC Start = "C:\\Windows\\SysWOW64\\EXKMTO\\SNC.exe"	SNC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\EXKMTO\SNC.002	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\EXKMTO\AKV.exe	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\EXKMTO\SNC.exe	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\EXKMTO\	SNC.exe
File created	C:\Windows\SysWOW64\EXKMTO\SNC.004	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\EXKMTO\SNC.001	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	SNC.exe
2368	SNC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2368	SNC.exe
Token: SeIncBasePriorityPrivilege	2368	SNC.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2368	SNC.exe
2368	SNC.exe
2368	SNC.exe
2368	SNC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2368	2968	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2368	2968	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2368	2968	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe	30
PID 2968 wrote to memory of 2368	2968	641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\641cd74ae74576b277820fea5bdb9aec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\EXKMTO\SNC.exe
  "C:\Windows\system32\EXKMTO\SNC.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\EXKMTO\AKV.exe

Filesize
487KB

MD5
eb9f503f6859a5161bcb9aeac042ceab

SHA1
d46039f98020e296bbd6455c834c6299528c821b

SHA256
51fc5b6f1711fd6b4b5945d935d37f57609eafa68d865c1ec1464b0ab221830c

SHA512
fa034d6292e0c16bb4958f1efe2b51577db99df6ccdb2223ba3fee4bab1796a5d4fa37667c077296da22e4c67d39ae0667a428f774aa2d5d3c7750a28320d33d

Download Submit
C:\Windows\SysWOW64\EXKMTO\SNC.001

Filesize
61KB

MD5
2666d675f8905ce58b7e961ffbfe8f61

SHA1
afa6625a916d27da14a591feba03352b2afb91cc

SHA256
1594c6986d0e4339825e2c812791c54c912d8358a76b6058da0bf6bba5f5c697

SHA512
81193afcb9406ea906db628ae434f576b6e4e2959674902cf8c2b11f5c7007b384a8e0385a6889637506f289d4849dd8dcb32dee9302363834333ef7813a2778

Download Submit
C:\Windows\SysWOW64\EXKMTO\SNC.002

Filesize
44KB

MD5
52f41f282445a7a75238c2bf31ff7b7d

SHA1
5b5c5eb4066e2c583137dff7e1333b89640514a7

SHA256
3a9e12f314bf9b5f043f3f05556b244a7ba244d3625f8adbd9cb59e9385ac4f3

SHA512
bc6e2959be659a86a2de4bb1dbae8171a6b02e39fd98e948c1c40e96e101e73af274e6ceb590fd5aa5e5cb558e8e80fb79aac0162cdc2266ab1b173bda419107

Download Submit
C:\Windows\SysWOW64\EXKMTO\SNC.004

Filesize
1KB

MD5
67986c892cf3630e19b1199e7b5ade6b

SHA1
7ad1fc8f4487fcfc36fb520a39ae34e32e93e8b0

SHA256
711945de361a344b5baa0db6bec8bfe9653a134b7ad48dc9577d073bf622f9cc

SHA512
968652acadc8ab2f6c1edff06375fe763b6347dd9d6846803713d61a4a2b8709699e79360bc6af317448c6faa9acbc01ee5fdf08e52c8e4d00e141312a532a52

Download Submit
\Windows\SysWOW64\EXKMTO\SNC.exe

Filesize
1.7MB

MD5
68c19411dc10799efff9cfdb1dfa6ea3

SHA1
b337a16ee1a383ff4406fdaf65816f67174a6ec6

SHA256
a8565859541d680f0d8c74acdc0e0fee438de817785f4f596e470bdbefca0855

SHA512
16a2d576df4a24fa7f973e8e588f8cc79281d03343510344e6ef4ff8e3903e3a7751f38ef4f1c9fa2f8bdfaf3181b4fecae6905833df861c98e5b7b993a429d3

Download Submit
memory/2368-15-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2368-17-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download