ardamax | 2641d55a4891becd0a31d0a5c791a96911bfb284367f90bd29e7b62f986a771d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
Size

521KB
MD5

ee1bd64183f6132bbc93df74b439d35c
SHA1

d54befc1c339b8182e596897dec4c615778bf057
SHA256

2641d55a4891becd0a31d0a5c791a96911bfb284367f90bd29e7b62f986a771d
SHA512

f11dc6e1c94d9eacde8ebe63e179cc83920afe7ca0d327f383042535d7317ffbc3ce8cc5e5411d088850ff2d4e28bb3979956ef16d285d42622a5770a83b2348
SSDEEP

12288:BbeMPyqafEWtVTTt57kBSjXutYjckvPqUAHkevHJmL32:gMPyqaZVTTwsjXE3kvPqUAHk6

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000156b8-13.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
1324	OPPC.exe
2416	SpeedHacker.exe

Loads dropped DLL 7 IoCs

pid	Process
2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
1324	OPPC.exe
2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
1324	OPPC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OPPC Agent = "C:\\Windows\\SysWOW64\\Sys32\\OPPC.exe"	OPPC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Sys32\OPPC.006	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\OPPC.exe	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\AKV.exe	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\OPPC.chm	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\OPPC.004	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\OPPC.001	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\OPPC.007	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\OPPC.003	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Sys32	OPPC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OPPC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1324	OPPC.exe
Token: SeIncBasePriorityPrivilege	1324	OPPC.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1324	OPPC.exe
1324	OPPC.exe
1324	OPPC.exe
1324	OPPC.exe
1324	OPPC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1324	2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe	28
PID 2404 wrote to memory of 1324	2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe	28
PID 2404 wrote to memory of 1324	2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe	28
PID 2404 wrote to memory of 1324	2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe	28
PID 2404 wrote to memory of 2416	2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe	29
PID 2404 wrote to memory of 2416	2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe	29
PID 2404 wrote to memory of 2416	2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe	29
PID 2404 wrote to memory of 2416	2404	ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee1bd64183f6132bbc93df74b439d35c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\Sys32\OPPC.exe
  "C:\Windows\system32\Sys32\OPPC.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\SpeedHacker.exe
  "C:\Users\Admin\AppData\Local\Temp\SpeedHacker.exe"
  2⤵
  - Executes dropped EXE
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SpeedHacker.exe

Filesize
19KB

MD5
0a1aca524b06966d25c43091dd23a00a

SHA1
9a4eefc45aee23759fd6437a62bb5f25b4d9bc1f

SHA256
d9e50e51c0795dceb09841077015372b6d9ed0d737bf51e71f5c882a76bf20bc

SHA512
54d16563bfddc09f08f6e48d4376f378fd0e2ea98d118c47e63741eea891fbaef69cfe90a6ff3a33bd4a60ca3b3b6520dbf2b0b56dfd7ca04521c5df7e03456c

Download Submit
C:\Windows\SysWOW64\Sys32\AKV.exe

Filesize
389KB

MD5
40f15729e871733ee4e3b526a72f0725

SHA1
43f4f1bb97a6e722ec796027aebd219199136833

SHA256
4ab6592bff060a990b7820e9ee412b4318fb47e85eb01c069fa797399991b472

SHA512
0f8b4bb24813334941d8cdcf137bdc7f4904648b97e5b92c448c053005a29d63c5ddfc6a7fdf1d3a7c1185b8c9dea15d13668bad963b651df6088dcfc32b7967

Download Submit
C:\Windows\SysWOW64\Sys32\OPPC.001

Filesize
474B

MD5
170d46c156a36989d9386296f9b0bf74

SHA1
b98a9959a0d4cafb237cd86072c19c9b3fd1fd3f

SHA256
55393c952de9b42a2860118c730acd91b4908c2aa56416b8d81ac883b0afac26

SHA512
6c1af1f8868eebdeea9f566aa490dcd1ed68884e6f378be62015752293ab10b9af6f24ace56375e3fdc5575b023ac0d3d348c91ebf719ff3ff8af6fee376bd5e

Download Submit
C:\Windows\SysWOW64\Sys32\OPPC.004

Filesize
14KB

MD5
2c10d8eaef09f65f6c918d8b6ca56dbc

SHA1
a498a1f88a08a5ee61f932606082c355133682b4

SHA256
66b828c1cc5ff4b58cb32e90ed28ea98b51c60631ff81aa67ff0c54a46eaf395

SHA512
671fa14db2bf32f28082a4cc5036ae5a0bb1476da188bab5d3950d0b0b594572f25331857e5ac80839edf4ca47e24b4ae7321af9f0731c31b4a4dda8c4485f03

Download Submit
C:\Windows\SysWOW64\Sys32\OPPC.006

Filesize
7KB

MD5
489d664845e0e001de7e6a87fb355366

SHA1
c0b339c9b8d18dad3b6f425b0eba2833ed313202

SHA256
aab3b216ae3c1415739d487c3d6df9af2b5d055959c289cd803e872b835d55fd

SHA512
7e403f33d0717a3e30664f9702de589c8065690dc423cf69245122e96db346c8112ed15ba53d6ab26c538a1fea9e63dd29a01e2f18be8c1ad439a5466d066be3

Download Submit
C:\Windows\SysWOW64\Sys32\OPPC.007

Filesize
5KB

MD5
8148ef191adcb3a30fbf777b1642dd06

SHA1
79027d2c6b2b14da631a133eeba2a0a102914e39

SHA256
ce5f8b7b0c338711fbc5359ed79c12139c6cdce2a5cdbb53797287800239c2e0

SHA512
8b285260652ce586fc4c8dd8ab26f726634fd50208e9278767461c37f9f4d98857a867322e312ee3b5bcbb9b33d9ff9cb055af7ec9318c2419244c2efcbb2153

Download Submit
C:\Windows\SysWOW64\Sys32\OPPC.chm

Filesize
33KB

MD5
e470d11ad5316b3412ff609594a45680

SHA1
04c6dab7c03e890a892b005d4755ffee58b491e6

SHA256
923d6518618349f5ca1354518e1237a86010939eed48d3e7edae6f4cc62e4a90

SHA512
c16d825f80146ae091f8a55efe626044488dedcab6c6aac4cf8f689f80533b5ec07e3c6ebe0e1542afba7ab6bd88a75184014db7aa4e9a1dbf4f2ae23237f84e

Download Submit
C:\Windows\SysWOW64\Sys32\OPPC.exe

Filesize
475KB

MD5
f7f2f0d8ed270a51c6bce37645b0e8dc

SHA1
3f48aff739c3add1bd951e28c4d11ec24e345adf

SHA256
fa0921f68dec9797bff50e5f3e466c01702eeeff254070c1705ced427edc725b

SHA512
a9c948ad52df9cd83cb4972938b1e1a1751e316d61303eb571ea47e3175d823545ec15951701173f40f1577cc644d1f612e477376730a5fb5d375f2683cc9092

Download Submit
\Users\Admin\AppData\Local\Temp\@9E23.tmp

Filesize
3KB

MD5
1af114b264a783148f112ae8a4392450

SHA1
bf5493d1c7794cc9e44f219a5038990215494fd4

SHA256
3071cfecb4af30dbfef855370ed538f332338c35b5f6d5d14045c144796f7ff9

SHA512
b9c833cca0adfad35cbe4392b170cb4820c50874f7b6cf1717a67007c95878e1980c2cbd283ffa671feec0c8794ac229551c5f0b38700d932840a7073f562355

Download Submit
memory/1324-29-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1324-43-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads