ardamax | 0e94dc6ed2c79b43e33e3d490db83e715cfbbe568670babed76990a072ac564f

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe
Size

1.2MB
MD5

391ab4b67cb9dff5dc2aa428d32a0c1d
SHA1

25a761373cf674c37ff326755a42b99b627d9811
SHA256

0e94dc6ed2c79b43e33e3d490db83e715cfbbe568670babed76990a072ac564f
SHA512

73f8891ef05192c3ab4c0478ff2f3e7840d3f3bb605bc5262fbcee13eca68aa9b51cd029b13a512aea7782a79202e6a3d1a3420314a409ba486cb9ce75c93c3e
SSDEEP

24576:lk/AT2aOrriL5O9qckCvQGJ2nkreQNtAvITbeI4fSRyuoSmWPb1fDoxU:6oT2aQridOw7wV2kTRpFfpLo

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b35-9.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3280	YID.exe
544	Diez V.1.3.exe

Loads dropped DLL 2 IoCs

pid	Process
3280	YID.exe
544	Diez V.1.3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YID Start = "C:\\Windows\\SysWOW64\\FYRQDT\\YID.exe"	YID.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Diez V.1.3.exe
File opened (read-only)	\??\L:	Diez V.1.3.exe
File opened (read-only)	\??\S:	Diez V.1.3.exe
File opened (read-only)	\??\X:	Diez V.1.3.exe
File opened (read-only)	\??\Y:	Diez V.1.3.exe
File opened (read-only)	\??\Z:	Diez V.1.3.exe
File opened (read-only)	\??\A:	Diez V.1.3.exe
File opened (read-only)	\??\E:	Diez V.1.3.exe
File opened (read-only)	\??\M:	Diez V.1.3.exe
File opened (read-only)	\??\O:	Diez V.1.3.exe
File opened (read-only)	\??\U:	Diez V.1.3.exe
File opened (read-only)	\??\B:	Diez V.1.3.exe
File opened (read-only)	\??\H:	Diez V.1.3.exe
File opened (read-only)	\??\K:	Diez V.1.3.exe
File opened (read-only)	\??\P:	Diez V.1.3.exe
File opened (read-only)	\??\V:	Diez V.1.3.exe
File opened (read-only)	\??\W:	Diez V.1.3.exe
File opened (read-only)	\??\I:	Diez V.1.3.exe
File opened (read-only)	\??\J:	Diez V.1.3.exe
File opened (read-only)	\??\R:	Diez V.1.3.exe
File opened (read-only)	\??\T:	Diez V.1.3.exe
File opened (read-only)	\??\N:	Diez V.1.3.exe
File opened (read-only)	\??\Q:	Diez V.1.3.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FYRQDT\YID.001	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\FYRQDT\YID.002	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\FYRQDT\AKV.exe	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\FYRQDT\YID.003	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\FYRQDT\YID.exe	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\FYRQDT\	YID.exe
File created	C:\Windows\SysWOW64\FYRQDT\YID.004	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YID.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Diez V.1.3.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	3280	YID.exe
Token: SeIncBasePriorityPrivilege	3280	YID.exe
Token: SeShutdownPrivilege	544	Diez V.1.3.exe
Token: SeCreatePagefilePrivilege	544	Diez V.1.3.exe
Token: SeShutdownPrivilege	544	Diez V.1.3.exe
Token: SeCreatePagefilePrivilege	544	Diez V.1.3.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3280	YID.exe
3280	YID.exe
3280	YID.exe
3280	YID.exe
544	Diez V.1.3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3280	2468	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe	86
PID 2468 wrote to memory of 3280	2468	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe	86
PID 2468 wrote to memory of 3280	2468	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe	86
PID 2468 wrote to memory of 544	2468	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe	87
PID 2468 wrote to memory of 544	2468	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe	87
PID 2468 wrote to memory of 544	2468	391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\391ab4b67cb9dff5dc2aa428d32a0c1d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\FYRQDT\YID.exe
  "C:\Windows\system32\FYRQDT\YID.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3280
- C:\Users\Admin\AppData\Local\Temp\Diez V.1.3.exe
  "C:\Users\Admin\AppData\Local\Temp\Diez V.1.3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
4822c09e0cd3455f6ed3ed4a52fd632f

SHA1
292d327219f7ae5958fef3eb2b4b0e63a59a38c2

SHA256
471805a1040f2d810d443a3512ae9586ab9de6b152f5712b4bdf0088e4568eb6

SHA512
de942ba01d0e210884272d3f4329a60e5834540146536c0e28e1df70c8acc5c874c601f7e7f5ffd83c98f4866b395dad296807ebcc947ac3b689b3bc65f29e3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Diez V.1.3.exe

Filesize
96KB

MD5
c63b2e5bfac6d4e3b83a39b91e539fb6

SHA1
c7a1cf6e2f4b8efcc114f64b12ab032323140670

SHA256
7e2fda7fd9f99c75db618a50119cfeb144a3de676bfaa7fe0693801fc817b8d2

SHA512
05d307988cbd772b95715649fed530b8705470d82eee77909a09435e3152ccadde5ed4096dc33692dcb65e44edf3cddf2119ca738672b71dbf3d6510b39af2f7

Download Submit
C:\Windows\SysWOW64\FYRQDT\AKV.exe

Filesize
463KB

MD5
eb916da4abe4ff314662089013c8f832

SHA1
1e7e611cc6922a2851bcf135806ab51cdb499efa

SHA256
96af80e7ba0f3997d59ebcb5ecef619f980d71ca29113e2cd2f2e8adcdea3061

SHA512
d0dbe1d1612982b9cd2a3ed3cbd3e3b5be49237f580f91d5e5d5b6d20ed4dc0babb69a666c19bf4e0f10776a43b9b1dcda91a4cd381ce3705b1795ef9d731c8b

Download Submit
C:\Windows\SysWOW64\FYRQDT\YID.001

Filesize
61KB

MD5
425ff37c76030ca0eb60321eedd4afdd

SHA1
7dde5e9ce5c4057d3db149f323fa43ed29d90e09

SHA256
70b00b09ae76a7ecfd6680ab22df546b17826755087c069fc87d14895e1a4e24

SHA512
ef5ff97c0d682b6155eff8f92dace1789cf01ca8bca55af1c1d0f2243b5e18bc12a657bb2bb12601b51ef9e1b942f02feb8462644da291fd1b2239c34ef2b59b

Download Submit
C:\Windows\SysWOW64\FYRQDT\YID.002

Filesize
43KB

MD5
12fb4f589942682a478b7c7881dfcba2

SHA1
a3d490c6cda965708a1ff6a0dc4e88037e0d6336

SHA256
4de0c277800ae36b85a11ed9765f732a73578d4dce053ff7179f96ab776fb60d

SHA512
dd1c6a4ea5bc9698701ec941c4e90fe8dfb0993dc321edc052d1a80cc49bc46be665a85ec678876e698de60cda5dbf1d6279742a16d648f9d18e642a3ea33ddd

Download Submit
C:\Windows\SysWOW64\FYRQDT\YID.003

Filesize
68KB

MD5
f47e8f65618e1b1f7e1720713f5a8c4c

SHA1
abad8e9e13b1e41f2af86e3c16526c6f2d05d952

SHA256
f170be2582c82ea131e1f688eea6e1cd17d14e6a9bb805b6aed2791e625a74d8

SHA512
635d617dbd15d00e2f7470857531b9820439a8816f2c74b3d83156599537ff42e26ea7d769863f2768eb2770ba9c47b1a10eb3e2677fe92b9eda6ae51da18dcb

Download Submit
C:\Windows\SysWOW64\FYRQDT\YID.004

Filesize
1KB

MD5
ef7b23bd37506cfdc73f477cfd2dc151

SHA1
828941eb2cc1c16044d9492f6289cdfd468b2c6b

SHA256
2f311a142cfdb14a82b8c1bb1fc16d97b219dcc07efab5b8997e886865309bde

SHA512
915cc1a69ffd41a1cb2973da7754f000df5226470b9ff49d76dd21951e40da71dd745c5ea46162eeeb6accb78a6d08b43dc4de66d676eae52704399a168edb76

Download Submit
C:\Windows\SysWOW64\FYRQDT\YID.exe

Filesize
1.5MB

MD5
f8530f0dfe90c7c1e20239b0a7643041

SHA1
3e0208ab84b8444a69c8d62ad0b81c4186395802

SHA256
734439c4049ae1a832b4cc5c8d227112106406945d1a7cbb355e11a3f5e356c4

SHA512
5cb01517938789e006e00d69729ae7d73ad480f1ae17a80059bf81ee5d9cebb1263a35732c84f03d742684a650b116b13e6731ca80b0b9cdb3908e5588649399

Download Submit
memory/3280-29-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3280-44-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads