ardamax | c9fe3c4f7a956a4b6696141dcf9d7f0a901bb93389581222543af3d7f0e40b37

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe
Size

270KB
MD5

01112e9bc69881fc7370c2ec08f5afe9
SHA1

d05a36a8bbe06cdbc81ce9d02f4bd43b89c72c1a
SHA256

c9fe3c4f7a956a4b6696141dcf9d7f0a901bb93389581222543af3d7f0e40b37
SHA512

80584564e9637a99414cf124651b0e043af0ce56b244bc612b6bc0ac593fd9af9ceb24b54964d5a6acd11679e70e0cc49e2a2bf2d2bbf08cbb8cfcb061159a93
SSDEEP

6144:G92Og70tpbRvY+yNJ9YK7eBlohQC1TEBUyJTzMBOBbp9OFZ2uh:G9aKbRhSsIez4cJTIMVSjZh

Score

10^/10

ardamax discovery keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002342f-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4792	MNQR.exe

Loads dropped DLL 1 IoCs

pid	Process
4772	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\28463\MNQR.007	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe
File created	C:\Windows\28463\MNQR.exe	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe
File created	C:\Windows\28463\MNQR.001	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe
File created	C:\Windows\28463\MNQR.006	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MNQR.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4792	4772	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe	82
PID 4772 wrote to memory of 4792	4772	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe	82
PID 4772 wrote to memory of 4792	4772	01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01112e9bc69881fc7370c2ec08f5afe9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\28463\MNQR.exe
  "C:\Windows\28463\MNQR.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@7F13.tmp

Filesize
4KB

MD5
908f7f4b0cf93759447afca95cd84aa6

SHA1
d1903a49b211bcb4a460904019ee7441420aa961

SHA256
3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

SHA512
958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

Download Submit
C:\Windows\28463\MNQR.001

Filesize
300B

MD5
3f1fc273dacf76bbe8f685cfce3665e4

SHA1
46190b540fe544fd5d7a02d64e3326419543ec0e

SHA256
ce58a6e6822cb0cb9ed229481898cb429039fc87125e262479e3d44e336b27cf

SHA512
5f877377e247be62437ef43a0c554bbbe3cdfff82c5c29a351592ac95df497d6ed3cdb68e75cd2f07dde676c393462c8b5abf7e748ded14f3815c7457a4b6fc7

Download Submit
C:\Windows\28463\MNQR.006

Filesize
7KB

MD5
e0fcfa7cad88d1a8a462cee6b06cf668

SHA1
a7e49078517abc929a6da261df06556c8f5a8cf0

SHA256
340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

SHA512
430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

Download Submit
C:\Windows\28463\MNQR.007

Filesize
5KB

MD5
ca72cd485d116033f1b776903ce7ee0a

SHA1
85b0b73a75b0498f56200dd1a5cf0de5371e42a3

SHA256
e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

SHA512
8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

Download Submit
C:\Windows\28463\MNQR.exe

Filesize
472KB

MD5
d7bd4739313a8e2fc9e080b7d0ba13b2

SHA1
808fcbe663bc02780b1d9962873a1e3066d55f05

SHA256
c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b

SHA512
d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398

Download Submit
memory/4792-21-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download