ardamax | 19afccd3792ae18bba4842d14b170557ad3985713ac80c2b7bfc3955f571a100

Analysis

max time kernel
150s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
Size

1.4MB
MD5

68df800443e9359f4d7dc5530044ec2d
SHA1

8e8e25689ecbf7416c21a492661b24e74275f0d0
SHA256

19afccd3792ae18bba4842d14b170557ad3985713ac80c2b7bfc3955f571a100
SHA512

634428202989cd5deca2d1ba5468998bb356b680b00f5f2d8444546010a40b7453985d991a96644d7bfda423cbd3db0aa4da4bd58abfdf947143ca6ada0ef5af
SSDEEP

24576:LZxTuWZLmq5haE9pOy+5EnUm/R41EuFmZUK7EPgGxT8CTRqitGIKnHK:LXTuWZL35hX+WlYMZihp8eQitGJ

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer upx

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023ca6-10.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	HXH.exe

Executes dropped EXE 2 IoCs

pid	Process
4788	HXH.exe
560	PerX inject.exe

Loads dropped DLL 2 IoCs

pid	Process
4788	HXH.exe
560	PerX inject.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HXH Start = "C:\\Windows\\SysWOW64\\FJBWJS\\HXH.exe"	HXH.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FJBWJS\HXH.003	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\FJBWJS\HXH.exe	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\FJBWJS\	HXH.exe
File created	C:\Windows\SysWOW64\FJBWJS\HXH.004	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\FJBWJS\HXH.001	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\FJBWJS\HXH.002	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\FJBWJS\AKV.exe	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\FJBWJS\HXH.chm	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023ca7-18.dat	upx
behavioral2/memory/560-32-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-37-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-38-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-40-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-41-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-42-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-43-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-45-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-48-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-49-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/560-52-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HXH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PerX inject.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe
560	PerX inject.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	4788	HXH.exe
Token: SeIncBasePriorityPrivilege	4788	HXH.exe
Token: SeIncBasePriorityPrivilege	4788	HXH.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4788	HXH.exe
4788	HXH.exe
4788	HXH.exe
4788	HXH.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4788	3556	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe	83
PID 3556 wrote to memory of 4788	3556	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe	83
PID 3556 wrote to memory of 4788	3556	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe	83
PID 3556 wrote to memory of 560	3556	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe	84
PID 3556 wrote to memory of 560	3556	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe	84
PID 3556 wrote to memory of 560	3556	68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe	84
PID 4788 wrote to memory of 1780	4788	HXH.exe	104
PID 4788 wrote to memory of 1780	4788	HXH.exe	104
PID 4788 wrote to memory of 1780	4788	HXH.exe	104

C:\Users\Admin\AppData\Local\Temp\68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68df800443e9359f4d7dc5530044ec2d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\FJBWJS\HXH.exe
  "C:\Windows\system32\FJBWJS\HXH.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\FJBWJS\HXH.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1780
- C:\Users\Admin\AppData\Local\Temp\PerX inject.exe
  "C:\Users\Admin\AppData\Local\Temp\PerX inject.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PerX inject.exe

Filesize
262KB

MD5
e974a7ed7fa0c096aa1f59ae6d8cce72

SHA1
24b215e712fa745ac94d033ee7c5a556a5df0dab

SHA256
d042a6add7b1547e5165d0c0c0f0eb21ee778b44c27e0a2bbce9f02b79156c0b

SHA512
156cfa7b252d8737a4d3fdc3f8095353051d7f15e1293d6c1213de36ea44d526fd94e75765b3a1f75ed83f9b02dd4329b9eab466e9188fea107e622d0c1d6ba4

Download Submit
C:\Windows\SysWOW64\FJBWJS\AKV.exe

Filesize
456KB

MD5
1f29b1075a91b3da0ccc0b9c49eece56

SHA1
048e675f087181035aedece9e7b11d065c6355cc

SHA256
4f6825548b32329c3360ed9abb7c0a6809a2c2291cf0bcaac511a9fa32a6336e

SHA512
7e152caf055f57f599ecc1e3a404b540b721b3315d2ba16bff6eb21f03edeb3a06ae185621e3139293612d94210f500f098bd281489ca7f336efd8b5284ee060

Download Submit
C:\Windows\SysWOW64\FJBWJS\HXH.001

Filesize
61KB

MD5
31c866d8e4448c28ae63660a0521cd92

SHA1
0e4dcb44e3c8589688b8eacdd8cc463a920baab9

SHA256
dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1

SHA512
1076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839

Download Submit
C:\Windows\SysWOW64\FJBWJS\HXH.002

Filesize
43KB

MD5
093e599a1281e943ce1592f61d9591af

SHA1
6896810fe9b7efe4f5ae68bf280fec637e97adf5

SHA256
1ac0964d97b02204f4d4ae79cd5244342f1a1798f5846e9dd7f3448d4177a009

SHA512
64cb58fbf6295d15d9ee6a8a7a325e7673af7ee02e4ece8da5a95257f666566a425b348b802b78ac82e7868ba7923f85255c2c31e548618afa9706c1f88d34dc

Download Submit
C:\Windows\SysWOW64\FJBWJS\HXH.003

Filesize
68KB

MD5
e62282afbb1c9f894927a0342f66e071

SHA1
1ab7481a0e770d92ac8ef50b56efa9730ce31a22

SHA256
0e9ad560a655389505223a02839368ed7a85deb0b9b19a3d0885a05f372d6811

SHA512
d5c44ab9f014c816be109e508e16eed753e47691df3f87980eafcc3b698ce11f6aff2650a526837d54312a26fe88dfdfc88d33c9bf4044971b654e8be250ff78

Download Submit
C:\Windows\SysWOW64\FJBWJS\HXH.004

Filesize
1KB

MD5
221dbb6f39a5146d84e1c81ab4282831

SHA1
101ca6c648d6d4df3f9849e68a5d5d7ab84498c0

SHA256
c472db17d705d5113c86fe7d5a34ce8df08b8c4d3078086bb450bc66a9474b73

SHA512
90fefd350e21e494799d47fdfad78c8caaa2f8032ccdb36ea60614208c7151257a1abb2a78d2767cbe76b7ee96688470e2b6ebee656dfe33f224c55503b326bc

Download Submit
C:\Windows\SysWOW64\FJBWJS\HXH.chm

Filesize
20KB

MD5
164ea98e2f64635f8a097870781da36c

SHA1
7cd9294657902f6bc199007e30f6514fce66f666

SHA256
c69e694d6db9a958a99901afb86a8b864a17b510a5dcdd1c176f53abf0c61a61

SHA512
4e19842a0d959876cdac60fd145fa36f2d98650b843c6faea2b01e205b2f0ce262b45c1c60fbf483320f012d4c00b96dff36e72d27ecbe9133f09d6618cbde20

Download Submit
C:\Windows\SysWOW64\FJBWJS\HXH.exe

Filesize
1.5MB

MD5
0aaffc12ef1b416b9276bdc3fdec9dff

SHA1
9f38d7cf6241d867da58f89db9ff26544314b938

SHA256
42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b

SHA512
bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c

Download Submit
memory/560-42-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-40-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-34-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/560-52-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-37-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-39-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/560-38-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-49-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-41-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-32-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-43-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-45-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/560-48-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4788-28-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/4788-36-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download