ardamax | df4fa7c74f5302285b9458974e06d07de65cb625bcecbc063fe9f6a927ca68da

Analysis

max time kernel
91s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Size

1020KB
MD5

0bee675df944e69e825f221df5e62834
SHA1

6278d31dcaa50685f8e607498cc105b6140bdfa6
SHA256

df4fa7c74f5302285b9458974e06d07de65cb625bcecbc063fe9f6a927ca68da
SHA512

3b0958ee54007d3e15139588b035c3018f030d347ba2cb424765a0f56df8c0dd1a5a46336cbdcc2a0c91298a7740b7df4601c19e58197fae2d0c94e7a1ae91fa
SSDEEP

24576:xUFYB1OlMu9k2vwKhKKXd5rCDOzB9iKq8JIBfD2VdpUncPuhS/:xt1O2BKlRzCDIB9iKq8SBC3pOcF/

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00050000000195d6-37.dat	family_ardamax

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2932	Exporer32.exe
2576	KWVE.exe

Loads dropped DLL 12 IoCs

pid	Process
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2932	Exporer32.exe
2932	Exporer32.exe
2932	Exporer32.exe
2576	KWVE.exe
2576	KWVE.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2052	DllHost.exe
2052	DllHost.exe
2932	Exporer32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KWVE Agent = "C:\\Windows\\SysWOW64\\28463\\KWVE.exe"	KWVE.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\KWVE.001	Exporer32.exe
File created	C:\Windows\SysWOW64\28463\KWVE.006	Exporer32.exe
File created	C:\Windows\SysWOW64\28463\KWVE.007	Exporer32.exe
File created	C:\Windows\SysWOW64\28463\KWVE.exe	Exporer32.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	Exporer32.exe
File opened for modification	C:\Windows\SysWOW64\28463	KWVE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KWVE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exporer32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ = "%CommonProgramFiles(x86)%\\Microsoft Shared\\DAO\\dao360.dll"	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\Class = "dao.TableDefClass"	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\RuntimeVersion = "v1.0.3705"	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ThreadingModel = "Apartment"	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ = "DAO.TableDef.36"	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\Assembly = "dao, Version=10.0.4504.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID\ = "DAO.TableDef.36"	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Token: 33	2576	KWVE.exe
Token: SeIncBasePriorityPrivilege	2576	KWVE.exe
Token: SeIncBasePriorityPrivilege	2576	KWVE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	DllHost.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
2576	KWVE.exe
2576	KWVE.exe
2576	KWVE.exe
2576	KWVE.exe
2576	KWVE.exe
2052	DllHost.exe
2052	DllHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2932	2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2932	2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2932	2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe	30
PID 2216 wrote to memory of 2932	2216	0bee675df944e69e825f221df5e62834_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2576	2932	Exporer32.exe	31
PID 2932 wrote to memory of 2576	2932	Exporer32.exe	31
PID 2932 wrote to memory of 2576	2932	Exporer32.exe	31
PID 2932 wrote to memory of 2576	2932	Exporer32.exe	31
PID 2576 wrote to memory of 2812	2576	KWVE.exe	33
PID 2576 wrote to memory of 2812	2576	KWVE.exe	33
PID 2576 wrote to memory of 2812	2576	KWVE.exe	33
PID 2576 wrote to memory of 2812	2576	KWVE.exe	33

C:\Users\Admin\AppData\Local\Temp\0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bee675df944e69e825f221df5e62834_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
  "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\28463\KWVE.exe
    "C:\Windows\system32\28463\KWVE.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\KWVE.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2812

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\laundry_007.jpg

Filesize
26KB

MD5
19d5ed881fafebf3347a356274c1e496

SHA1
2053ce37c39cee360b4b8a042ddc6f0ea0843ef6

SHA256
2ceaabe5176c0fbca94342fd718cfcaf0f065419f4f3ab584dc09a86026f555f

SHA512
046170fd068f7c8fc200b80795621d6d00b40bdb48828ba502c9cc496868632a87929794f559c836f13d4121aaeaa1c8259231499b33f1c4af204175c30dcabd

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
395KB

MD5
adbec81b510dcfe49835f95940ef961d

SHA1
77940f6e46fbd5f53de23bd49afe9172470769d0

SHA256
466efb4b00255f21075b340fc2d2444f182947ab90270840543658c5fd3a9b95

SHA512
ef4324a06fbe960933f5551ea6ac587cd87cb6025bc6879a2b81a4d1033cfe87e244b6a87fb5db5ad065321ccbe8035cf24a668452d5b0c6a4063a355a12b2a7

Download Submit
C:\Windows\SysWOW64\28463\KWVE.001

Filesize
450B

MD5
c09bc97f8d66c59a1bb8b14707e4399c

SHA1
84c6ae17f87424e3f07c4af979964cde6d16d343

SHA256
661ab56e7de6dbaba82919f57be250bcd0149d08207cbccd57f50be4f0d2d62f

SHA512
c4c508791f211f7bbed790ffa149e3e6d81fe7980366a898b8c9fe7fbb40d8ad67f2cee68bf624899dc00174aedea30c77ff901e74467f43bdbbf6fbece1e054

Download Submit
C:\Windows\SysWOW64\28463\KWVE.exe

Filesize
473KB

MD5
3c90d45b1c004e86a7f7a7a340f1abc8

SHA1
10602c450bcbda2735dc036f2e399646f0c64f4c

SHA256
f6d9c3bba7fc4dfa681cadf68f41093e3c431501c6789e891e599719e5d2781c

SHA512
85457be4c2aa76ede288cd185131d46e5f0b37187313f3a54fe789e28929ec6e44282f4ba0981f46354705cd5da83990586c8846f52fcdb807908254c8719cc1

Download Submit
\Users\Admin\AppData\Local\Temp\@7ADB.tmp

Filesize
4KB

MD5
13e10cd76f11d6cb43182dcba7370171

SHA1
e6b8ce329e49ff09f1cb529c60fc466cb9a579c8

SHA256
f1265c88f0077009eaa18db413f156cc7ad8d41dc9d797dd1032b0e0ae9c40d5

SHA512
ee32ef3f50838936417e51dfd365b166456900e327dbe51902700bb3d562dea22e6fbd9009c822ba0562687001802a2e61d38123f81ae19f7b3d05bb1fd5cda8

Download Submit
\Users\Admin\AppData\Local\Temp\Exporer32.exe

Filesize
507KB

MD5
a5f7f3556110e2f9e19d537aea8a10be

SHA1
26d7fef9f3c6bee6539a4717f6d5989608727568

SHA256
71907e7cd27b2925e0a8288173e2271fd9974d45fd5294dac9e4cb4686f4523f

SHA512
ae68338dda0d29e6da3db95291a6060f50d6a8fb103e35ce42fd3c1fe2d2fd193b215d1c3a7fdd04578b80bd36c52b986ecf7ab2948d7bbe926853969e41b2e1

Download Submit
\Windows\SysWOW64\28463\KWVE.006

Filesize
8KB

MD5
f5eff4f716427529b003207d5c953df5

SHA1
79696d6c8d67669ea690d240ef8978672e3d151c

SHA256
ac54ebb9eec3212f294462ce012fdc42f4b0896d785d776a5a2cc3599dc5bcde

SHA512
5a48599a5855f06c3e7d6f89c4e06bab1f4381b9d30cf3824c465b8fd6c142b316e6bd6aaad73d1f9b3e84d96113fb5e7374831bf503744013c9e1a0632a0caf

Download Submit
\Windows\SysWOW64\28463\KWVE.007

Filesize
5KB

MD5
bc75eddaa64823014fef0fe70bd34ffc

SHA1
15cd2ace3b68257faed33c78b794b2333eab7c0a

SHA256
9eada36d17635bedb85ce96a62cb019dbfee696b9986f69de7d5b5bc1f44df5d

SHA512
20db25f32f9cfdbffa4f30c0065125052c6e20b7dcc147fa7ebff38e37b51f6a43e48e486f148d7ee11671479b9fb0bbe1c6df151101af3b50c65fd334d13baa

Download Submit
memory/2052-57-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download
memory/2216-54-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2216-0-0x0000000000550000-0x000000000059D000-memory.dmp

Filesize
308KB

Download
memory/2216-6-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2216-7-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2216-53-0x0000000000550000-0x000000000059D000-memory.dmp

Filesize
308KB

Download
memory/2216-45-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2216-8-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2216-9-0x0000000000550000-0x000000000059D000-memory.dmp

Filesize
308KB

Download
memory/2216-5-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2576-46-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2932-56-0x00000000005A0000-0x00000000005A2000-memory.dmp

Filesize
8KB

Download