ardamax | acdce20a28eae9e0253497f5ed7ccc9827aa54254124ab47601bf44c10e448cd

Analysis

max time kernel
142s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

113a82cdda525571103288979052871b_JaffaCakes118.exe
Size

1.6MB
MD5

113a82cdda525571103288979052871b
SHA1

653b6898222f5b0c9694c3610dd5c436cc13cbe9
SHA256

acdce20a28eae9e0253497f5ed7ccc9827aa54254124ab47601bf44c10e448cd
SHA512

76780c45331041f6cabcc804c205b81b39f619e00dd6bb557db32d218a578b1ebb905797f3763188d2270c514d11b4bc1338df81e22d784a8464de6de875bc6e
SSDEEP

24576:SKvrMDxOvt40bwzaPYDyBTnCL1u2tHTyrMs3kt75QrrkmN/XgtUya3pS0w2oaxQf:Olz0bwyxdAmrrq+0mNI+/FQRhP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000019334-33.dat	family_ardamax

Executes dropped EXE 3 IoCs

pid	Process
1992	OrderFile.exe
2660	DTD.exe
2920	EXCEL.EXE

Loads dropped DLL 8 IoCs

pid	Process
3020	113a82cdda525571103288979052871b_JaffaCakes118.exe
1992	OrderFile.exe
1992	OrderFile.exe
2660	DTD.exe
2660	DTD.exe
1992	OrderFile.exe
1992	OrderFile.exe
2920	EXCEL.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DTD Start = "C:\\Windows\\SysWOW64\\AVMEKS\\DTD.exe"	DTD.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\AVMEKS\DTD.004	OrderFile.exe
File created	C:\Windows\SysWOW64\AVMEKS\DTD.001	OrderFile.exe
File created	C:\Windows\SysWOW64\AVMEKS\DTD.002	OrderFile.exe
File created	C:\Windows\SysWOW64\AVMEKS\AKV.exe	OrderFile.exe
File created	C:\Windows\SysWOW64\AVMEKS\DTD.exe	OrderFile.exe
File opened for modification	C:\Windows\SysWOW64\AVMEKS\	DTD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrderFile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DTD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	113a82cdda525571103288979052871b_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2920	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe
Token: 33	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe
Token: 33	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe
Token: 33	1992	OrderFile.exe
Token: SeIncBasePriorityPrivilege	1992	OrderFile.exe
Token: 33	2660	DTD.exe
Token: SeIncBasePriorityPrivilege	2660	DTD.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2660	DTD.exe
2660	DTD.exe
2660	DTD.exe
2660	DTD.exe
2920	EXCEL.EXE
2920	EXCEL.EXE
2920	EXCEL.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1992	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe	30
PID 3020 wrote to memory of 1992	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe	30
PID 3020 wrote to memory of 1992	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe	30
PID 3020 wrote to memory of 1992	3020	113a82cdda525571103288979052871b_JaffaCakes118.exe	30
PID 1992 wrote to memory of 2660	1992	OrderFile.exe	31
PID 1992 wrote to memory of 2660	1992	OrderFile.exe	31
PID 1992 wrote to memory of 2660	1992	OrderFile.exe	31
PID 1992 wrote to memory of 2660	1992	OrderFile.exe	31
PID 1992 wrote to memory of 2920	1992	OrderFile.exe	32
PID 1992 wrote to memory of 2920	1992	OrderFile.exe	32
PID 1992 wrote to memory of 2920	1992	OrderFile.exe	32
PID 1992 wrote to memory of 2920	1992	OrderFile.exe	32
PID 1992 wrote to memory of 2920	1992	OrderFile.exe	32
PID 1992 wrote to memory of 2920	1992	OrderFile.exe	32
PID 1992 wrote to memory of 2920	1992	OrderFile.exe	32
PID 1992 wrote to memory of 2920	1992	OrderFile.exe	32
PID 1992 wrote to memory of 2920	1992	OrderFile.exe	32

C:\Users\Admin\AppData\Local\Temp\113a82cdda525571103288979052871b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\113a82cdda525571103288979052871b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- \DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.12.08T19.25\Virtual\STUBEXE\8.0.1112\@APPDATALOCAL@\Temp\OrderFile.exe
  "C:\Users\Admin\AppData\Local\Temp\OrderFile.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1992
- - \DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.12.08T19.25\Native\STUBEXE\8.0.1112\@SYSTEM@\AVMEKS\DTD.exe
    "C:\Windows\system32\AVMEKS\DTD.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2660
- - \DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.12.08T19.25\Native\STUBEXE\8.0.1112\@PROGRAMFILES@\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Quotation.xlsx

Filesize
191KB

MD5
be477786a126f5f1f52cb2d3948f9ab0

SHA1
daf553b4fec750833ae3fe040c01cafa4e06ca13

SHA256
44262ec48dc79a4b87afaeb04a1ed4ee5b54da1e51befca6a44ac704f3db1957

SHA512
b4f8273dc1c034fd7f21a5801f5c4ffbe7830da5a14a088b9b980e4ea21fc57fa9cff08dda3a479bd7a8380719fe87cd0117ef0ce089c486329d1a51088349cb

Download Submit
C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.12.08T19.25\Native\STUBEXE\8.0.1112\@PROGRAMFILES@\Microsoft Office\Office14\EXCEL.EXE

Filesize
17KB

MD5
bf957af35253aa1b7c69967d70ff784c

SHA1
3568e582abf94f361a4aaac2bbbd081c9fdcfe9d

SHA256
3e80fe01fb5ac616d9433be94410ce02b6a3b537ec9ab416d5a66adac99e2bad

SHA512
cde00e8283fd1938298e97ad6daf12b5d307ce6d4084559417703d394d9b13baa9738f11ec2b1b0781f97c9aab7a51cdbcf8f8f26b25e20a9b6c357ff1175e61

Download Submit
C:\Windows\SysWOW64\AVMEKS\AKV.exe

Filesize
456KB

MD5
51507d91d43683b9c4b8fafeb4d888f8

SHA1
ead2f68338da7af4720378cd46133589fc9405ba

SHA256
71b3aecefd36e4855a369019ac5871c544d39f8889d23cd455466a24cdecce6b

SHA512
a5a7ff3f8ffb72719b7e2c9dc2719c99ea32bd68994918ea027c0d7d54cfe0c80bfd34486dd8d3cdd390376bc4c8d1f7d97de4b98b7d39a3e10c3e2682c07d1c

Download Submit
C:\Windows\SysWOW64\AVMEKS\DTD.001

Filesize
61KB

MD5
383d5f5d4240d590e7dec3f7312a4ac7

SHA1
f6bcade8d37afb80cf52a89b3e84683f4643fbce

SHA256
7e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422

SHA512
e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a

Download Submit
C:\Windows\SysWOW64\AVMEKS\DTD.002

Filesize
43KB

MD5
93df156c4bd9d7341f4c4a4847616a69

SHA1
c7663b32c3c8e247bc16b51aff87b45484652dc1

SHA256
e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e

SHA512
ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35

Download Submit
C:\Windows\SysWOW64\AVMEKS\DTD.004

Filesize
1KB

MD5
37b5242db43391629865f006f0a8f6f9

SHA1
e04d6bed1db2afcb4c827af0ee2ae68be90a7e60

SHA256
7fdc8e0309a3b2e7f4271fe1962144a95316d2074bbec2e2b0353fb715d62fbb

SHA512
ecaff5fb1d3b57df715be16ef477a1ac899e4ac7a7ce67719ad2565eb124507492ae2172309b8f2e932bd52c1c7032ecccdad340aefd13e0a0db3d5c47ebb5e3

Download Submit
C:\Windows\SysWOW64\AVMEKS\DTD.exe

Filesize
1.7MB

MD5
3cd29c0df98a7aeb69a9692843ca3edb

SHA1
7c86aea093f1979d18901bd1b89a2b02a60ac3e2

SHA256
5a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32

SHA512
e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.12.08T19.25\Native\STUBEXE\8.0.1112\@SYSTEM@\AVMEKS\DTD.exe

Filesize
17KB

MD5
5ad5ce498fac2b6510499870b193d58e

SHA1
f8ebae3e1063b7953f61511ecdd225ee52ccad85

SHA256
41b22f1d0b3f7895b66bd03145a0cb52c9c351c3c5f9f3bf113c1407784e170c

SHA512
a7d5c56a42814bb71b3fdbd924a9f7f192f19c4e5ebbe42cfec47b7dc0aabcf13a69b80de393dd85bb5cace5e72695f6f2ed3b80e8925739c4998c0b44ab7113

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.12.08T19.25\Virtual\STUBEXE\8.0.1112\@APPDATALOCAL@\Temp\OrderFile.exe

Filesize
17KB

MD5
4541d72c2f6af90aa0cfe9eab6d8b980

SHA1
93ee7be554c86b4636e6f73d46df105ed3ecaa99

SHA256
5f5e571761ba204b6c8114d8997b452b6649f37127e5ffa4295dd68bfca75b22

SHA512
5008c5b61c3e2eefac4a619c2f48784cb7539eac1ee769afffe3a88db187c3081fff943e8268fee149d461d6fdf58908b4d042e1ad66720fed8e7613c585eda5

Download Submit
memory/1992-42-0x00000000005D0000-0x0000000000642000-memory.dmp

Filesize
456KB

Download
memory/1992-17-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1992-62-0x00000000005D0000-0x0000000000642000-memory.dmp

Filesize
456KB

Download
memory/1992-23-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1992-20-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1992-21-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/1992-22-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2660-56-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-55-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-50-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-53-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-58-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-59-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-68-0x00000000005C0000-0x0000000000632000-memory.dmp

Filesize
456KB

Download
memory/2660-60-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-61-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-51-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-45-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-46-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-47-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-49-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-52-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-57-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2660-54-0x0000000000400000-0x00000000005B3000-memory.dmp

Filesize
1.7MB

Download
memory/2920-82-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-73-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-99-0x00000000004B0000-0x0000000000522000-memory.dmp

Filesize
456KB

Download
memory/2920-97-0x00000000004B0000-0x0000000000522000-memory.dmp

Filesize
456KB

Download
memory/2920-96-0x00000000004B0000-0x0000000000522000-memory.dmp

Filesize
456KB

Download
memory/2920-94-0x00000000004B0000-0x0000000000522000-memory.dmp

Filesize
456KB

Download
memory/2920-93-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2920-75-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-76-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-77-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-80-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-84-0x00000000004B0000-0x0000000000522000-memory.dmp

Filesize
456KB

Download
memory/2920-81-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-79-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-74-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-72-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/2920-78-0x0000000030000000-0x00000000313D1000-memory.dmp

Filesize
19.8MB

Download
memory/3020-0-0x0000000000360000-0x00000000003D2000-memory.dmp

Filesize
456KB

Download
memory/3020-12-0x0000000003780000-0x00000000038D5000-memory.dmp

Filesize
1.3MB

Download
memory/3020-14-0x0000000003780000-0x00000000038D5000-memory.dmp

Filesize
1.3MB

Download
memory/3020-13-0x0000000003780000-0x00000000038D5000-memory.dmp

Filesize
1.3MB

Download
memory/3020-10-0x0000000000360000-0x00000000003D2000-memory.dmp

Filesize
456KB

Download
memory/3020-2-0x0000000077280000-0x0000000077281000-memory.dmp

Filesize
4KB

Download
memory/3020-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3020-4-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/3020-24-0x0000000000360000-0x00000000003D2000-memory.dmp

Filesize
456KB

Download
memory/3020-15-0x0000000003780000-0x00000000038D5000-memory.dmp

Filesize
1.3MB

Download
memory/3020-5-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/3020-6-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/3020-7-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/3020-8-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/3020-1-0x0000000077280000-0x0000000077281000-memory.dmp

Filesize
4KB

Download
memory/3020-9-0x0000000000360000-0x00000000003D2000-memory.dmp

Filesize
456KB

Download
memory/3020-105-0x0000000000360000-0x00000000003D2000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads