ardamax | 90e3f085c4bdcdb3d111e83e4f2cafc77458426bbffb3b007c7a6441e432755f

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
Size

1.1MB
MD5

9d8985067e7133a62cb9d1f45cf04ba4
SHA1

b543033ca185f3e8467df35807a936ca98168f68
SHA256

90e3f085c4bdcdb3d111e83e4f2cafc77458426bbffb3b007c7a6441e432755f
SHA512

a46f189e56848868b61a05c667020d1d76eca632ab9a98669852491c12f2a0808611ce4b301a5bede4747dc2738f58ba73c518e022f9a9eb1e6df8159b83ff4e
SSDEEP

24576:9tfsJb5pjhkpRvOEJuGWvxCHoeehq9kUsIENhdBYo9NHAVwEWIE:9JsPpjKP2MCJ/hqRsI+6alE8

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00060000000175e4-637.dat	family_ardamax

Executes dropped EXE 3 IoCs

pid	Process
1292	Install.exe
2952	QALG.exe
2740	cmd.exe

Loads dropped DLL 10 IoCs

pid	Process
2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
1292	Install.exe
1292	Install.exe
1292	Install.exe
2952	QALG.exe
2952	QALG.exe
2952	QALG.exe
2952	QALG.exe
2952	QALG.exe
2952	QALG.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QALG Agent = "C:\\Windows\\SysWOW64\\28463\\QALG.exe"	QALG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\QALG.001	Install.exe
File created	C:\Windows\SysWOW64\28463\QALG.006	Install.exe
File created	C:\Windows\SysWOW64\28463\QALG.007	Install.exe
File created	C:\Windows\SysWOW64\28463\QALG.exe	Install.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	Install.exe
File opened for modification	C:\Windows\SysWOW64\28463	QALG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QALG.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: 33	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
Token: 33	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
Token: 33	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
Token: 33	1292	Install.exe
Token: SeIncBasePriorityPrivilege	1292	Install.exe
Token: 33	2952	QALG.exe
Token: SeIncBasePriorityPrivilege	2952	QALG.exe
Token: SeIncBasePriorityPrivilege	2952	QALG.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2952	QALG.exe
2952	QALG.exe
2952	QALG.exe
2952	QALG.exe
2952	QALG.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1292	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1292	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1292	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1292	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1292	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1292	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe	30
PID 2200 wrote to memory of 1292	2200	9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe	30
PID 1292 wrote to memory of 2952	1292	Install.exe	31
PID 1292 wrote to memory of 2952	1292	Install.exe	31
PID 1292 wrote to memory of 2952	1292	Install.exe	31
PID 1292 wrote to memory of 2952	1292	Install.exe	31
PID 1292 wrote to memory of 2952	1292	Install.exe	31
PID 1292 wrote to memory of 2952	1292	Install.exe	31
PID 1292 wrote to memory of 2952	1292	Install.exe	31
PID 2952 wrote to memory of 2740	2952	QALG.exe	32
PID 2952 wrote to memory of 2740	2952	QALG.exe	32
PID 2952 wrote to memory of 2740	2952	QALG.exe	32
PID 2952 wrote to memory of 2740	2952	QALG.exe	32
PID 2952 wrote to memory of 2740	2952	QALG.exe	32
PID 2952 wrote to memory of 2740	2952	QALG.exe	32
PID 2952 wrote to memory of 2740	2952	QALG.exe	32

C:\Users\Admin\AppData\Local\Temp\9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9d8985067e7133a62cb9d1f45cf04ba4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Xenocode\Sandbox\avast\avast.2.3.4\2012.05.31T11.08\Virtual\STUBEXE\@APPDATALOCAL@\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Users\Admin\AppData\Local\Xenocode\Sandbox\avast\avast.2.3.4\2012.05.31T11.08\Native\STUBEXE\@SYSTEM@\28463\QALG.exe
    "C:\Windows\system32\28463\QALG.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Users\Admin\AppData\Local\Xenocode\Sandbox\avast\avast.2.3.4\2012.05.31T11.08\Native\STUBEXE\@SYSTEM@\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\QALG.exe > nul
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\AKV.exe

Filesize
457KB

MD5
46ccfd974518e5849738449034a05a17

SHA1
d391108816aed7ba8f7beb205ad7171c74eae6b2

SHA256
571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe

SHA512
773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a

Download Submit
C:\Windows\SysWOW64\28463\QALG.001

Filesize
376B

MD5
6039e2729894ae98835a982f74ed7809

SHA1
58a8dc8078b69e9832b9458db97daad76a02f42f

SHA256
b356355cdb79807a616d5ea9688cdf03afd5e5f85eaeafca685142749de1f36d

SHA512
8c53e9a712197d43094f1d3da952dbce21dc9c054059408a8264fa5b7a8eae441c316bc19c95dc79175441d474b2e98975718d2403b86ee9271c994bee7dde1e

Download Submit
C:\Windows\SysWOW64\28463\QALG.exe

Filesize
912KB

MD5
6768ba61744862704760b66ce8f8fdd4

SHA1
e86cbed8cf20c2a9c76219d0c434bc310ffb2392

SHA256
4cf4bf2b7d2bb4215e255e1f2b1238ad989f3c8a98ebfd5cb033bccf32fedaa0

SHA512
eadb56b633707724ef4f47f8b421b0f3b2afa5a9800fae030f81aefae483eed6b494da470278273f388c3ae346a33cbbfe742924d231dab1c9b42bbefaf95a61

Download Submit
\Users\Admin\AppData\Local\Temp\@F2F6.tmp

Filesize
4KB

MD5
a55cbc0f0125b005ef369020b4c17806

SHA1
010af3e2e84b337e91f5e0c791b01e1d527211ce

SHA256
27cfe74936e4090aafbef07ee45725923f4b1243135e1e3a51e3385dbcd7b637

SHA512
88e5f7905c86d73bc5af028f20c8bf49f700307926c5b92814c245abe08e9c35841116d428ddbd7b957b47ccc8980684c12608b6818e4b6c1c8c0d27d54a07be

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\avast\avast.2.3.4\2012.05.31T11.08\Native\STUBEXE\@SYSTEM@\28463\QALG.exe

Filesize
17KB

MD5
7dc485265b98ac1ef6e7d66c0eba9e08

SHA1
0242e4db7ca541c302c0ed3ebe3e418877a50351

SHA256
fc71f01e6be952b846d221e83e1274f04e88e322480d6572b81efb122e277731

SHA512
4ae1ada129e1fe7d89e0f2c807fe6ad353182d1c5c9c7cbc768f22791f799ce2bd0df4d8581c58a88ec05ba21dba537a4ff5383d17f277d71c07aac555d6d39e

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\avast\avast.2.3.4\2012.05.31T11.08\Native\STUBEXE\@SYSTEM@\cmd.exe

Filesize
17KB

MD5
a6bb1229030921e98aade90362b8e36b

SHA1
7944ee4dc63d7e1b9be245c2d6f1877c27747788

SHA256
8f2342ddb9d971ae938690ca621e25a74cf82eeb1a6c05eef3159e3092f3d2b0

SHA512
3dc54461117cbb9f2735559a1d823cd72b769956829bccd8e824c9035a84735213b2e68a4269f1604cc4f5f4e59520a9db9be289ffd69fd1b96b916fe7c6dcda

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\avast\avast.2.3.4\2012.05.31T11.08\Virtual\STUBEXE\@APPDATALOCAL@\Temp\Install.exe

Filesize
17KB

MD5
06e746bbd24495581a5cca7436fca56b

SHA1
66629b8c87f6eedcccf5f6376c08128950efa824

SHA256
0f18c4d5eac6035a96b8d39ee9044c02de760075712d418b4355bc0aa4894b3d

SHA512
d73ffa655b334c33e60e1b103cf310b9879e1c52143e375f9a121c6ec61adbb47f4c0dcc9f7991076188ee90920a9cc099d3fde32df71a8ffe6d7992439963da

Download Submit
\Windows\SysWOW64\28463\QALG.006

Filesize
8KB

MD5
395bbef326fa5ad1216b23f5debf167b

SHA1
aa4a7334b5a693b3f0d6f47b568e0d13a593d782

SHA256
7c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1

SHA512
dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679

Download Submit
\Windows\SysWOW64\28463\QALG.007

Filesize
5KB

MD5
1b5e72f0ebd49cf146f9ae68d792ffe5

SHA1
1e90a69c12b9a849fbbac0670296b07331c1cf87

SHA256
8f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e

SHA512
6364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc

Download Submit
memory/1292-645-0x0000000002C10000-0x0000000002CF3000-memory.dmp

Filesize
908KB

Download
memory/2200-46-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-33-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-318-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-317-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-316-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-314-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-313-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-312-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-300-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-287-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-202-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-195-0x0000000077670000-0x0000000077671000-memory.dmp

Filesize
4KB

Download
memory/2200-194-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-193-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-170-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-127-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-106-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-66-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-64-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-62-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-60-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-55-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-56-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-51-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-261-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-47-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-44-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-42-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-37-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-38-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-35-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-276-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-31-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-29-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-27-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-25-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-23-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-21-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-19-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-15-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-13-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-11-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-9-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-7-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-5-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-3-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-1-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-0-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-311-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-53-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-958-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-185-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-128-0x0000000077670000-0x0000000077671000-memory.dmp

Filesize
4KB

Download
memory/2200-92-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2200-69-0x0000000000390000-0x00000000003FC000-memory.dmp

Filesize
432KB

Download
memory/2952-670-0x00000000004F0000-0x00000000005D3000-memory.dmp

Filesize
908KB

Download
memory/2952-650-0x00000000004F0000-0x00000000005D3000-memory.dmp

Filesize
908KB

Download
memory/2952-965-0x00000000004F0000-0x00000000005D3000-memory.dmp

Filesize
908KB

Download
memory/2952-966-0x00000000004F0000-0x00000000005D3000-memory.dmp

Filesize
908KB

Download
memory/2952-968-0x0000000002300000-0x00000000023E3000-memory.dmp

Filesize
908KB

Download
memory/2952-957-0x0000000002300000-0x00000000023E3000-memory.dmp

Filesize
908KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads