ardamax | e95ebb45afdac7356a97d3eb55d258455f6365015d58251d7c816a4cee30bbb6

Analysis

max time kernel
141s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe
Size

6.0MB
MD5

17ec7b40d5c8baeeb1e7ae06ca3a8e43
SHA1

41f85f0918d25e68cb567cd68708aa057e037b09
SHA256

e95ebb45afdac7356a97d3eb55d258455f6365015d58251d7c816a4cee30bbb6
SHA512

1d6dbeb0662ab898577e1d622c1a3fe425a96c3b3e9072f8f92f94a3206b2d9bab4906b82708fd639a77f294052dc860e79ac150fd0856737dabfbc58c6a5188
SSDEEP

98304:WULyZ0GkBkM+AII+/51I6awlp901a89e9SCcYRXKoVpb7ih4osB/m/d71leTNuWI:HLIoII+/jaGp94xm9X5VpbY4oskd71+2

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234c0-34.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	Vo não -Quero não_REMIX.exe

Executes dropped EXE 3 IoCs

pid	Process
1592	Vo não -Quero não_REMIX.exe
3352	ResHacker.exe
5024	JELM.exe

Loads dropped DLL 9 IoCs

pid	Process
1592	Vo não -Quero não_REMIX.exe
5024	JELM.exe
1592	Vo não -Quero não_REMIX.exe
1592	Vo não -Quero não_REMIX.exe
5024	JELM.exe
5024	JELM.exe
3352	ResHacker.exe
3352	ResHacker.exe
3352	ResHacker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JELM Agent = "C:\\Windows\\SysWOW64\\28463\\JELM.exe"	JELM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\JELM.006	Vo não -Quero não_REMIX.exe
File created	C:\Windows\SysWOW64\28463\JELM.007	Vo não -Quero não_REMIX.exe
File created	C:\Windows\SysWOW64\28463\JELM.exe	Vo não -Quero não_REMIX.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	Vo não -Quero não_REMIX.exe
File opened for modification	C:\Windows\SysWOW64\28463	JELM.exe
File created	C:\Windows\SysWOW64\28463\JELM.001	Vo não -Quero não_REMIX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vo não -Quero não_REMIX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ResHacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JELM.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	Vo não -Quero não_REMIX.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3144	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3144	vlc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	5024	JELM.exe
Token: SeIncBasePriorityPrivilege	5024	JELM.exe
Token: 33	3652	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3652	AUDIODG.EXE
Token: 33	3144	vlc.exe
Token: SeIncBasePriorityPrivilege	3144	vlc.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3144	vlc.exe
3144	vlc.exe
3144	vlc.exe
3144	vlc.exe
3144	vlc.exe
3144	vlc.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3144	vlc.exe
3144	vlc.exe
3144	vlc.exe
3144	vlc.exe
3144	vlc.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2124	17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe
5024	JELM.exe
5024	JELM.exe
5024	JELM.exe
5024	JELM.exe
5024	JELM.exe
3144	vlc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1592	2124	17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe	82
PID 2124 wrote to memory of 1592	2124	17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe	82
PID 2124 wrote to memory of 1592	2124	17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe	82
PID 2124 wrote to memory of 3352	2124	17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe	83
PID 2124 wrote to memory of 3352	2124	17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe	83
PID 2124 wrote to memory of 3352	2124	17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe	83
PID 1592 wrote to memory of 5024	1592	Vo não -Quero não_REMIX.exe	84
PID 1592 wrote to memory of 5024	1592	Vo não -Quero não_REMIX.exe	84
PID 1592 wrote to memory of 5024	1592	Vo não -Quero não_REMIX.exe	84
PID 1592 wrote to memory of 3144	1592	Vo não -Quero não_REMIX.exe	85
PID 1592 wrote to memory of 3144	1592	Vo não -Quero não_REMIX.exe	85

C:\Users\Admin\AppData\Local\Temp\17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17ec7b40d5c8baeeb1e7ae06ca3a8e43_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\Vo não -Quero não_REMIX.exe
  "C:\Users\Admin\AppData\Local\Temp\Vo não -Quero não_REMIX.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\28463\JELM.exe
    "C:\Windows\system32\28463\JELM.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5024
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\VO NÃO POSSO NÃO QUERO NÃO - REMIX DANCE DJ SANDRO.mp3"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3144
- C:\Users\Admin\AppData\Local\Temp\ResHacker.exe
  "C:\Users\Admin\AppData\Local\Temp\ResHacker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3352

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x428 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@8FEC.tmp

Filesize
4KB

MD5
c3679c3ff636d1a6b8c65323540da371

SHA1
d184758721a426467b687bec2a4acc80fe44c6f8

SHA256
d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb

SHA512
494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ResHacker.exe

Filesize
917KB

MD5
2e7b63f9114f31382c2686fafccffd18

SHA1
975bc6db7b249868473097f1997868a9c98330a3

SHA256
adefd7558323c54c7d47f480b5ae7b87ec99dd87e6d7bf0cdd3d1e65f37d77fe

SHA512
2a3b5a3d31aaec561a076ff154f818d8cc4d0a46329deaf52aaf8533114f53bf90655c79bd4a148433b73b256395af5c228fe0dbd8f4ddf9633f8bf1e6dcae2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\VO NÃO POSSO NÃO QUERO NÃO - REMIX DANCE DJ SANDRO.mp3

Filesize
4.7MB

MD5
f2b71f69e4be895678633a282c800f0a

SHA1
8984c9b06c6139e56e133d0bb44b2cd4248b5287

SHA256
7886446b6b4023fcbab116162115de60ce711655126ec3780d0896248af8b2c1

SHA512
d0fd6007c3f6139db61601a8a4be2e81226407cc508b0fb3a4956e8d2bbb69477bf89377cde839532a719061fe4f9c421019cc902f6838d0ed972dd082782dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vo não -Quero não_REMIX.exe

Filesize
5.0MB

MD5
03e423603eacbef6eb90e756400197d2

SHA1
8f47fc6821b4f77819271a1c640f6191e17595af

SHA256
60c6d96c914ac2fe17ab7a888575434c6abfbdd52d91f06e2fb6aff8bf3a8ce5

SHA512
bb5bb72dc44def3c65596583b1db9fb989f3a59efa86adb4e7e8d959d80bba3bb38092a7db6d3e705cc42e731c90d829bde5e46b9aff1454668f7697bed233fb

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
395KB

MD5
b8fa30233794772b8b76b4b1d91c7321

SHA1
0cf9561be2528944285e536f41d502be24c3aa87

SHA256
14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a

SHA512
10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d

Download Submit
C:\Windows\SysWOW64\28463\JELM.001

Filesize
608B

MD5
1e4b591a104ff8ba0101ce804a8b3019

SHA1
8a6b7cd95d6d52848de1ba89debca08742b45366

SHA256
6b5b5fb9947d1114a866927e07c4c5d3a865b9dde5c1efcce252731788f113ef

SHA512
d07508570dc244a665494e17d134ef5857827d41f0f735fe7193c2fb87df5ebe302234ff9fbdae39559f826a50cd45720a047f8f97fb5e04d132f80a84f799d0

Download Submit
C:\Windows\SysWOW64\28463\JELM.006

Filesize
8KB

MD5
43f02e9974b1477c1e6388882f233db0

SHA1
f3e27b231193f8d5b2e1b09d05ae3a62795cf339

SHA256
3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba

SHA512
e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

Download Submit
C:\Windows\SysWOW64\28463\JELM.007

Filesize
5KB

MD5
b5a87d630436f958c6e1d82d15f98f96

SHA1
d3ff5e92198d4df0f98a918071aca53550bf1cff

SHA256
a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2

SHA512
fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

Download Submit
C:\Windows\SysWOW64\28463\JELM.exe

Filesize
473KB

MD5
17535dddecf8cb1efdba1f1952126547

SHA1
a862a9a3eb6c201751be1038537522a5281ea6cb

SHA256
1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd

SHA512
b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

Download Submit
memory/3144-73-0x00007FFCC6B90000-0x00007FFCC6BA1000-memory.dmp

Filesize
68KB

Download
memory/3144-71-0x00007FFCCA480000-0x00007FFCCA491000-memory.dmp

Filesize
68KB

Download
memory/3144-117-0x00007FFCB6310000-0x00007FFCB73C0000-memory.dmp

Filesize
16.7MB

Download
memory/3144-67-0x00007FFCC9FD0000-0x00007FFCCA004000-memory.dmp

Filesize
208KB

Download
memory/3144-66-0x00007FF7F43B0000-0x00007FF7F44A8000-memory.dmp

Filesize
992KB

Download
memory/3144-75-0x00007FFCC69A0000-0x00007FFCC69B1000-memory.dmp

Filesize
68KB

Download
memory/3144-74-0x00007FFCC6B50000-0x00007FFCC6B6D000-memory.dmp

Filesize
116KB

Download
memory/3144-78-0x00007FFCC65D0000-0x00007FFCC6611000-memory.dmp

Filesize
260KB

Download
memory/3144-76-0x00007FFCB73C0000-0x00007FFCB75CB000-memory.dmp

Filesize
2.0MB

Download
memory/3144-72-0x00007FFCC6E00000-0x00007FFCC6E17000-memory.dmp

Filesize
92KB

Download
memory/3144-68-0x00007FFCB75D0000-0x00007FFCB7886000-memory.dmp

Filesize
2.7MB

Download
memory/3144-79-0x00007FFCC6910000-0x00007FFCC6931000-memory.dmp

Filesize
132KB

Download
memory/3144-70-0x00007FFCCC200000-0x00007FFCCC217000-memory.dmp

Filesize
92KB

Download
memory/3144-69-0x00007FFCCDFC0000-0x00007FFCCDFD8000-memory.dmp

Filesize
96KB

Download
memory/3144-84-0x00007FFCB44B0000-0x00007FFCB44C7000-memory.dmp

Filesize
92KB

Download
memory/3144-83-0x00007FFCC6570000-0x00007FFCC6581000-memory.dmp

Filesize
68KB

Download
memory/3144-82-0x00007FFCC6590000-0x00007FFCC65A1000-memory.dmp

Filesize
68KB

Download
memory/3144-77-0x00007FFCB6310000-0x00007FFCB73C0000-memory.dmp

Filesize
16.7MB

Download
memory/3144-81-0x00007FFCC65B0000-0x00007FFCC65C1000-memory.dmp

Filesize
68KB

Download
memory/3144-80-0x00007FFCC6730000-0x00007FFCC6748000-memory.dmp

Filesize
96KB

Download
memory/3352-64-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3352-26-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/3352-65-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads