ardamax | 4432f01f7ca9a77e76353b0121e346058186b787217c8cd7960c67232f9cdca8

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe
Size 1.0MB
Sample240813-mcb8wasfpr
SHA256 4432f01f7ca9a77e76353b0121e346058186b787217c8cd7960c67232f9cdca8
MD5 92a7db0ef60666dc0feed76e58655175
SHA1 d22b8f8db956324d178712f533dfe3001ca1faae
SHA512 56b07cb93a4079d42a1a89e91111fd77fdfa4d95ad2ff4eab10251bf99d20730ad66f4db783f57589abb3fbae289447283777c23388b98eb3a44f761b59daf94
SSDEEP 24576:DvybJvA4bLjVxlFhrS8bul0cTEbR7T/i1qE/VWFri:cvAmxlF2pTEbR7Li4aAi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234a7-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3932	system32NELM.exe
3216	OwnTibia.exe

Loads dropped DLL 7 IoCs

pid	Process
1836	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe
3932	system32NELM.exe
3216	OwnTibia.exe
3932	system32NELM.exe
3932	system32NELM.exe
3216	OwnTibia.exe
3216	OwnTibia.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system32NELM Agent = "C:\\Windows\\system32NELM.exe"	system32NELM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32NELM.001	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe
File created	C:\Windows\system32NELM.006	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe
File created	C:\Windows\system32NELM.007	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe
File created	C:\Windows\system32NELM.exe	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe
File created	C:\Windows\system32AKV.exe	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32NELM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OwnTibia.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3932	system32NELM.exe
Token: SeIncBasePriorityPrivilege	3932	system32NELM.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3932	system32NELM.exe
3932	system32NELM.exe
3932	system32NELM.exe
3932	system32NELM.exe
3932	system32NELM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 3932	1836	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe	86
PID 1836 wrote to memory of 3932	1836	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe	86
PID 1836 wrote to memory of 3932	1836	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe	86
PID 1836 wrote to memory of 3216	1836	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe	87
PID 1836 wrote to memory of 3216	1836	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe	87
PID 1836 wrote to memory of 3216	1836	92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92a7db0ef60666dc0feed76e58655175_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\system32NELM.exe
  "C:\Windows\system32NELM.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3932
- C:\Users\Admin\AppData\Local\Temp\OwnTibia.exe
  "C:\Users\Admin\AppData\Local\Temp\OwnTibia.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@881C.tmp

Path C:\Users\Admin\AppData\Local\Temp\@881C.tmp
Size 4KB
SHA256 fe9304a2f41e446e3672a26b338cde680d34fd07b0c5a6866ef108366ed92eb9
MD5 08c0e7cb9f56d7a8f6acfd2268ea7142
SHA1 e885ffa0db9b4dd38e547135eb5446cc89fe6865
SHA512 6325410c99d703b3181c4eb4d9cbcdf1d8e08cc57a8ef7c8334e5be02b2499997829a3d6fd708dd83541efd1712330c5163daffe68a09aa2863cc76d5cbdccf9
MD5 SHA1 SHA512

Submit Download

OwnTibia.exe

Path C:\Users\Admin\AppData\Local\Temp\OwnTibia.exe
Size 840KB
SHA256 3e7819454d463f26aaf399751be439ff7b156930a712a602de876f7fc1b23900
MD5 d20be195aecf64019d0d18ecc4f3eee3
SHA1 8abf31c5a695f5a37b515844a556f6f76f561190
SHA512 740de1c4d58c11fff477bac37b1951bebbf5bea027eaf4cf516de69f5f451dcbd7376e42558a5178e173595bde11aa13818b7a4e33374f3f05163931227aa743
SSDEEP 12288:bideWkzXLWf056Jx1BnUcufPjmGIZIgAjNjD9A3f8sBzJqnPl:benknWf05qB/IPGCJfgLRaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32NELM.001

Path C:\Windows\system32NELM.001
Size 406B
SHA256 0ac9f0424cc976f53605bdd3c32932f78d84de156f2fa78a2ae4b1d6b18f5f3f
MD5 9b720f09b03c3239cd2779f2f781d482
SHA1 0ae84552d36ae1b78e3d33405e3afd929b469b29
SHA512 bc81a09e48b0f30a1c007727c8d325b1db7f360e438570e966f994a269f2223f5fd365e06d8da76f16f1f2173090124e403f18359989d7bcc450f1c3b811d1ee
MD5 SHA1 SHA512

Submit Download

system32NELM.006

Path C:\Windows\system32NELM.006
Size 7KB
SHA256 af73b0a6c98eec78e121cb1fed4ee4b5df052833242179cdeec04c75b6df2cfc
MD5 840a1ae793d07aed4585781697178bc1
SHA1 5d42f9763e32c1dced9cdd14144926c43044d6ad
SHA512 078ddc10ebccd4c108e52555ae7aeb644aadfc006dbc2aa1aad319b6e9bd35b779fee9e3d063c22f48a7e082e1a01e1f70ab11f8c26827750b13a1c8cb636689
SSDEEP 192:Y3mYO95ofcXXyY1chCCRZH4yD6pN0idx:k9fcHyY1qN6peidx
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32NELM.007

Path C:\Windows\system32NELM.007
Size 5KB
SHA256 037e9a3e82e1a8902d8220c82650e52f549d6acc490ff30481a497130b7208f2
MD5 530d177fa3d66ca092ecbdb4eb02a0d9
SHA1 868a3c3fa51df0fe5ffbba3aeeca20aa23da0fc4
SHA512 44d84513aaab0eb5f2c0c9be64cc78beb8caf0ddf6039fe726d39834d19d4c1084cec1611b565529920d4edf4d432dba6e67a01d94a845b7fd083dd284545002
SSDEEP 48:6gklbhQo80EE/KD4XJ2zlN03UHu2X3VIECi1cBaVM+kHv8:6gSEDM+N03+nKECiRQHv8
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32NELM.exe

Path C:\Windows\system32NELM.exe
Size 471KB
SHA256 84ce204e2d8ef6cc519fbabf8356999de06af6250ca4a170ecfb776952d855ca
MD5 040be8249f1b7b90730867c398e40568
SHA1 d6908d242bed9d7d04dcf98c7e46571121f0b7f1
SHA512 3c63436c6412f127a2ca64891af185678cde71846c52331ae4dda03b1313392ba3655699305d6ce05723d50aec0e4d227616536592bb5a23449e1eaddba94516
SSDEEP 6144:cpzPAwsgBWd/Dww+cLsCgqR6bjEh4OzpFR+9mvEXfg/AV5NvL99Ab:mMxgBWd/DT7R6xmpFRGib
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3216-37-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/3216-38-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/3216-40-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/3932-30-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads