ardamax | 1f870144603d776ce4514b3c745a7b1a0b04d17482b59d98f43b2a5d325c601e

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe
Size

952KB
MD5

56e5ef2eb4001b992bde0c406a69b059
SHA1

8201517a8f5f90d8f278bba84e3e7dc4f1082a07
SHA256

1f870144603d776ce4514b3c745a7b1a0b04d17482b59d98f43b2a5d325c601e
SHA512

69b950db5b6287ae662a8eac68be2cb8024b17fcd5927d219230627bf3897462d1d126c0b4eb7aac020b5752a943c3180c45a329f68aa412001291b6a14edd7a
SSDEEP

12288:tYYKXuEe/OernBZ9yhoBSR5gO5g26u3SfLyHNlb2u6lAXEh5YaYmpUzgASAGi0hl:+pkmezBTyTNsLytlbZ0AXEv2hGiJtp+

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00050000000193d4-29.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2236	SHACO.exe
2760	XIHF.exe

Loads dropped DLL 8 IoCs

pid	Process
2492	56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe
2492	56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe
2236	SHACO.exe
2236	SHACO.exe
2760	XIHF.exe
2348	DllHost.exe
2760	XIHF.exe
2348	DllHost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XIHF Agent = "C:\\Windows\\SysWOW64\\28463\\XIHF.exe"	XIHF.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\XIHF.001	SHACO.exe
File created	C:\Windows\SysWOW64\28463\XIHF.006	SHACO.exe
File created	C:\Windows\SysWOW64\28463\XIHF.007	SHACO.exe
File created	C:\Windows\SysWOW64\28463\XIHF.exe	SHACO.exe
File created	C:\Windows\SysWOW64\28463\key.bin	SHACO.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	SHACO.exe
File opened for modification	C:\Windows\SysWOW64\28463	XIHF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SHACO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XIHF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\ProgID\	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0\0\	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0\	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0\0	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\Version\ = "1.0"	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\VersionIndependentProgID\ = "PLA.LegacyTraceSessionCollection"	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\InprocServer32\ = "%SystemRoot%\\SysWow64\\pla.dll"	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\ProgID	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0\0\win32\ = "%SystemRoot%\\SysWow64\\sdiagnhost.exe"	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0\0\win64\ = "%SystemRoot%\\SysWow64\\sdiagnhost.exe"	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\Version	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\VersionIndependentProgID\	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\InprocServer32\	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\LocalServer32\	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\LocalServer32\ = "%SystemRoot%\\SysWow64\\plasrv.exe"	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\ProgID\ = "PLA.LegacyTraceSessionCollection.1"	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\TypeLib\ = "{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}"	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\VersionIndependentProgID	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0\0\win32	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0\0\win32\	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0\0\win64\	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\Version\	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\InprocServer32	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\ = "Obiwegeg Erodo object"	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}\1.0\0\win64	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\TypeLib	XIHF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\TypeLib\	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95EDB0AA-5E5F-4CEE-A1B2-706F79476444}\LocalServer32	XIHF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9FF1AF4-03FA-AC4D-4A6E-7E0304858B82}	XIHF.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2760	XIHF.exe
Token: SeIncBasePriorityPrivilege	2760	XIHF.exe
Token: SeIncBasePriorityPrivilege	2760	XIHF.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2348	DllHost.exe
2348	DllHost.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2760	XIHF.exe
2760	XIHF.exe
2760	XIHF.exe
2760	XIHF.exe
2760	XIHF.exe
2348	DllHost.exe
2348	DllHost.exe
2348	DllHost.exe
2348	DllHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2236	2492	56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2236	2492	56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2236	2492	56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2236	2492	56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe	31
PID 2236 wrote to memory of 2760	2236	SHACO.exe	32
PID 2236 wrote to memory of 2760	2236	SHACO.exe	32
PID 2236 wrote to memory of 2760	2236	SHACO.exe	32
PID 2236 wrote to memory of 2760	2236	SHACO.exe	32
PID 2760 wrote to memory of 1160	2760	XIHF.exe	34
PID 2760 wrote to memory of 1160	2760	XIHF.exe	34
PID 2760 wrote to memory of 1160	2760	XIHF.exe	34
PID 2760 wrote to memory of 1160	2760	XIHF.exe	34

C:\Users\Admin\AppData\Local\Temp\56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\56e5ef2eb4001b992bde0c406a69b059_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\SHACO.exe
  "C:\Users\Admin\AppData\Local\Temp\SHACO.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\28463\XIHF.exe
    "C:\Windows\system32\28463\XIHF.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\XIHF.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1160

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mandarin.jpg

Filesize
26KB

MD5
5360862be8e10d223cabb8d5165b3219

SHA1
b57da0070559eabd3691d6fe64cad182591a82e9

SHA256
0611f2850ecede61614e81a55f9f1e7989486934723f7d7479cc9d46cca79e9d

SHA512
03b7d25745c6871073b34d347751ec18ea18a5dcd26112ffa6c6f2bba7bf3df9af69c1593f4cbce3f622f16cd8233a631d2137138ba3df5b58f3079a0641f3d3

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
457KB

MD5
42e2202ac32edb39ccf9979515018d85

SHA1
c1e07fbe2fa759e2775d4dcf7de23a66d2422a1a

SHA256
367b4028baf3df4a5f77169bd64c9ef8fd7968a4d6c852ae3f81a726f4b37222

SHA512
a97d9e968b1f63dedba74999aabe6fd150aae985c1143d29b183cc0d663a45252c57494c3457136c5e500050c6af6c819f9ba7070b7d62300ede2e9a7c792768

Download Submit
C:\Windows\SysWOW64\28463\XIHF.001

Filesize
452B

MD5
7793385cc452a9d24ced45b11f390fe4

SHA1
0fe360d954d7fca719779f5a09a6038a008edaf0

SHA256
066898cd05ecd5121d5c3cd4931e62d2acaa3ba21d26bee7d0ce439682f04ce6

SHA512
81e938f69cd762eccba7ad0f9ffb1a58e43185ed132add77112c03e3f0a9be33b45b40a2eafbb1001788b72314e4dc21f038d31b8ddbb52c5b39d1d59f5bf40e

Download Submit
C:\Windows\SysWOW64\28463\XIHF.006

Filesize
8KB

MD5
3da3041787b72a7909d9f6184ce6bc5e

SHA1
fc7f00b8a1341b5341e2ba6f94ba85364bc90843

SHA256
18e06896cc71e99b717cff8d68cba86fea3eba5087b93734f6418e53cadab5b3

SHA512
150fa3f8eeec3621ac61eab0da3f2692dd776887ec0c1791404df3dd8784982563496e1e990217a99c4fd53c5d5d68e0574737879b72d78ab737033f1b08560a

Download Submit
C:\Windows\SysWOW64\28463\XIHF.007

Filesize
5KB

MD5
50d0bcf6b5a6b11d9e274ccefba3f02e

SHA1
57acf2a1236b7534f2db661a9d95aeadcd41aa2a

SHA256
a5e5cf8b3133031f25db37fd13b029cdfc9d1588ca7f68041e52349f46cbbf5c

SHA512
c0288f92c75f4a6ea45434e3960a3c5d8ed3d890121a3fd6da2449e1313db523224e301451d85a15ea8ee9b5c2fb3bf294ee90869a4d5608bcf48fa94458e938

Download Submit
C:\Windows\SysWOW64\28463\key.bin

Filesize
105B

MD5
27c90d4d9b049f4cd00f32ed1d2e5baf

SHA1
338a3ea8f1e929d8916ece9b6e91e697eb562550

SHA256
172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb

SHA512
d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae

Download Submit
\Users\Admin\AppData\Local\Temp\@B1E1.tmp

Filesize
4KB

MD5
cb07753c45624238b4403480372be5db

SHA1
10af5bfbed599165d996470278f011728e866df7

SHA256
63c3ed8cbe11314a2f2cd6ff50305bad98075be9e09d22e45b47af557a3388e7

SHA512
2c72cca45ef924104c6892dd96f2e27a5d43bacc9f3eb0eeee24c871cc1bd1642d77734822d9d934f93a77c884fa1c682cf1ceddffe157a613978d9edd184312

Download Submit
\Users\Admin\AppData\Local\Temp\SHACO.exe

Filesize
809KB

MD5
18fc1c9ac123d7b8149bec150a7e1b84

SHA1
e1cb8425b3406bd487917dbd87f76f23f3d38c85

SHA256
d6b40332e006014758c0356b9875d14237c1e69cb9c14db55e2d11bebce2c2b9

SHA512
4b9d47b01206139692a3c05018b5144ce134fdaa92b7563cc2f9923c88b208073a797d0df95488938e392f3678513000984f82a020482cd3d0eed307375b2778

Download Submit
\Windows\SysWOW64\28463\XIHF.exe

Filesize
647KB

MD5
a7b322839cedf8d56cb0a7dcdb50ab59

SHA1
d27855e65f5d9e87666f39d2af694a0d75330a75

SHA256
ba7362315c0608c9203c9d607fd85695fbc15f034ea40b3de7dd1abebd5859a3

SHA512
86a416ae639ca458e56093d5c04f3406ac0389cf9a1047f714424ba89ffd047ca58e6927bc941d285d4db9e8a95e91e0d578be3038a83945b6af90586ea9f649

Download Submit
memory/2236-37-0x0000000002A10000-0x0000000002AEF000-memory.dmp

Filesize
892KB

Download
memory/2236-39-0x0000000002C10000-0x0000000002C12000-memory.dmp

Filesize
8KB

Download
memory/2348-6-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2348-5-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2348-52-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2492-4-0x0000000002BC0000-0x0000000002BC2000-memory.dmp

Filesize
8KB

Download
memory/2760-53-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2760-56-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2760-60-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads