ardamax | e5ac1c5c3af3a07d55dc9a5f7a866a3d00027dcd6db2aaf2e7809c0f038873d1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe
Size

171KB
MD5

b22e6adc3b992a11b3c1ebcc917b09ee
SHA1

933d6d338cc86f6e81670af33deae879eef8f227
SHA256

e5ac1c5c3af3a07d55dc9a5f7a866a3d00027dcd6db2aaf2e7809c0f038873d1
SHA512

6bb419e59e47c5aa025781dc2585d07c9abceca0f3176245033909bf9740f8d0e79d753a1326a0da66578c61c1a14fd8f122a24974d95ed95b1f5899946a6639
SSDEEP

3072:0OZHQaGFIvd1aCNWeX6pzqvOO0v2wTUGtao9ferweQxKFSNsbvcL:lGSdk4By40pTUXaUwegKtcL

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000175f7-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2228	NSK.exe

Loads dropped DLL 3 IoCs

pid	Process
1712	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe
1712	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe
1712	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NSK = "C:\\Windows\\SysWOW64\\NSK.exe"	NSK.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NSK.007	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NSK.exe	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NSK.001	NSK.exe
File created	C:\Windows\SysWOW64\NSK.001	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NSK.006	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NSK.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2228	1712	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe	29
PID 1712 wrote to memory of 2228	1712	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe	29
PID 1712 wrote to memory of 2228	1712	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe	29
PID 1712 wrote to memory of 2228	1712	b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b22e6adc3b992a11b3c1ebcc917b09ee_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\NSK.exe
  "C:\Windows\system32\NSK.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\NSK.001

Filesize
1KB

MD5
c98abb03cd7149f99fb50bda0b615229

SHA1
758316a161df0d92c6876c7b5cbbf54b91c6d227

SHA256
ad8dbadded1227e91c85d11b5fbff4c72a7279d715c7c66aaefde691b49f332a

SHA512
dd977da9c42df49284490c10b9e684140594b0a4bc0c1b5fc50d99a6f3b421196d1b23e5626853ae34cdc0b1f0e721fde00dfdf76608ba0a8fae3b0d219afd8d

Download Submit
\Users\Admin\AppData\Local\Temp\@F69E.tmp

Filesize
4KB

MD5
ccfd350414f3804bbb32ddd7eb3f6153

SHA1
e91d270b8481d456a3beabf617ef3379a93f1137

SHA256
1dabedfe9c7cda2d8aa74c95ba57fb832a4066b20f4051c0330b4422de237eb3

SHA512
328e069aaced9217eb9f4b4f20e27cd7ef933427e3388b3a0829089d694ea2280a2e5511a9eb577cec2a7b409cf367b0f17d8654076931648e152936fad810bd

Download Submit
\Windows\SysWOW64\NSK.exe

Filesize
239KB

MD5
2bada91f44e2a5133a5c056b31866112

SHA1
9fbe664832d04d79f96fa090191b73d9811ef08d

SHA256
c742feab59b4e1b7b188b02ed91ab34eaeb83c87ac6babfb5f08649ed2b8cd02

SHA512
dc797a06061937f8dd657a34d4373d3069c9c1a6752752516042e5d135fc41257c7a3a6738b3accd626a02f1887476197eca0ab28cf568daf57269cbe9c8eb41

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads