ardamax | d2df375f9853334dd8e6452cd39bcb36f35b2655f5dd0c6b561c5dec14f2b83f

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
Size

1.7MB
MD5

beaa1f0dc5452016828bfa0a68e01090
SHA1

30adf694516a4a6529d561edb5e9ea6e278774b4
SHA256

d2df375f9853334dd8e6452cd39bcb36f35b2655f5dd0c6b561c5dec14f2b83f
SHA512

14ca9bcb4b8fc7bbda189162e67ebcbc2f79b36248dcf5dcaabdd872d002bac691e152f78d67784c21fba776fad6c6ff75c89935c7fc2f3d32c993885258d05f
SSDEEP

49152:KY2EUa3anSmNdYhZk9qGWiPI/NNotF5GgSrdQ/Wf6I:VASsYrk9xPI/NNGTGg3Wf6I

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c49-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3584	UUPU.exe
4696	mirc616.exe

Loads dropped DLL 7 IoCs

pid	Process
4120	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
3584	UUPU.exe
4696	mirc616.exe
3584	UUPU.exe
3584	UUPU.exe
4696	mirc616.exe
4696	mirc616.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UUPU Agent = "C:\\Windows\\SysWOW64\\Sys32\\UUPU.exe"	UUPU.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Sys32\AKV.exe	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\UUPU.004	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\UUPU.003	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Sys32	UUPU.exe
File opened for modification	C:\Windows\SysWOW64\Sys32\UUPU.009	UUPU.exe
File created	C:\Windows\SysWOW64\Sys32\UUPU.006	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\UUPU.007	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\UUPU.exe	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\UUPU.009.tmp	UUPU.exe
File created	C:\Windows\SysWOW64\Sys32\Dec_03_2024__18_30_59.jpg	UUPU.exe
File created	C:\Windows\SysWOW64\Sys32\Dec_03_2024__18_31_59.jpg	UUPU.exe
File created	C:\Windows\SysWOW64\Sys32\UUPU.001	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Sys32\UUPU.009	UUPU.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\mIRC\popups.ini	mirc616.exe
File created	C:\Program Files\mIRC\mirc.hlp	mirc616.exe
File created	C:\Program Files\mIRC\readme.txt	mirc616.exe
File created	C:\Program Files\mIRC\versions.txt	mirc616.exe
File created	C:\Program Files\mIRC\aliases.ini	mirc616.exe
File created	C:\Program Files\mIRC\servers.ini	mirc616.exe
File created	C:\Program Files\mIRC\urls.ini	mirc616.exe
File created	C:\Program Files\mIRC\mirc.exe	mirc616.exe
File created	C:\Program Files\mIRC\ircintro.hlp	mirc616.exe
File created	C:\Program Files\mIRC\mirc.ini	mirc616.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UUPU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mirc616.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3584	UUPU.exe
Token: SeIncBasePriorityPrivilege	3584	UUPU.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3584	UUPU.exe
3584	UUPU.exe
3584	UUPU.exe
3584	UUPU.exe
3584	UUPU.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 3584	4120	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe	83
PID 4120 wrote to memory of 3584	4120	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe	83
PID 4120 wrote to memory of 3584	4120	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe	83
PID 4120 wrote to memory of 4696	4120	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe	84
PID 4120 wrote to memory of 4696	4120	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe	84
PID 4120 wrote to memory of 4696	4120	beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\beaa1f0dc5452016828bfa0a68e01090_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\Sys32\UUPU.exe
  "C:\Windows\system32\Sys32\UUPU.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3584
- C:\Users\Admin\AppData\Local\Temp\mirc616.exe
  "C:\Users\Admin\AppData\Local\Temp\mirc616.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@8CFE.tmp

Filesize
3KB

MD5
1af114b264a783148f112ae8a4392450

SHA1
bf5493d1c7794cc9e44f219a5038990215494fd4

SHA256
3071cfecb4af30dbfef855370ed538f332338c35b5f6d5d14045c144796f7ff9

SHA512
b9c833cca0adfad35cbe4392b170cb4820c50874f7b6cf1717a67007c95878e1980c2cbd283ffa671feec0c8794ac229551c5f0b38700d932840a7073f562355

Download Submit
C:\Users\Admin\AppData\Local\Temp\mirc616.exe

Filesize
1.2MB

MD5
875a57102ad6bec1ed9bb6861b016c74

SHA1
63ae418690f3e632f0b68e7202dea82a63d1bcd7

SHA256
03d7c6043223daff4e5d634c0976a92c84ae007b8ad6f4b049883282abdaf967

SHA512
125b965b98579e7e0d7d8eb40b8ba755c13b4e69ab4e290681f81de5f56a0df28ade856faac1d6e47e59d5802ee9d5bff8f55ff6c9563add0475cbb8b07e63f8

Download Submit
C:\Windows\SysWOW64\Sys32\AKV.exe

Filesize
389KB

MD5
40f15729e871733ee4e3b526a72f0725

SHA1
43f4f1bb97a6e722ec796027aebd219199136833

SHA256
4ab6592bff060a990b7820e9ee412b4318fb47e85eb01c069fa797399991b472

SHA512
0f8b4bb24813334941d8cdcf137bdc7f4904648b97e5b92c448c053005a29d63c5ddfc6a7fdf1d3a7c1185b8c9dea15d13668bad963b651df6088dcfc32b7967

Download Submit
C:\Windows\SysWOW64\Sys32\UUPU.001

Filesize
460B

MD5
589e7727f8eb2374a974ae8f9954fd35

SHA1
617615dd406487999307353cef852d005aa66f83

SHA256
c07db56f64d0dfd70525862f380a86e4a125c07e772983ed205cc7646bab43f9

SHA512
94ae162d3f13d753793877f56e78b7e85c8a1abadb6f30002dc453c84987f40060043a7816acaf2eb4968865d9baf455a30d6c6a9594d93e60d36e82919c2765

Download Submit
C:\Windows\SysWOW64\Sys32\UUPU.004

Filesize
14KB

MD5
2c10d8eaef09f65f6c918d8b6ca56dbc

SHA1
a498a1f88a08a5ee61f932606082c355133682b4

SHA256
66b828c1cc5ff4b58cb32e90ed28ea98b51c60631ff81aa67ff0c54a46eaf395

SHA512
671fa14db2bf32f28082a4cc5036ae5a0bb1476da188bab5d3950d0b0b594572f25331857e5ac80839edf4ca47e24b4ae7321af9f0731c31b4a4dda8c4485f03

Download Submit
C:\Windows\SysWOW64\Sys32\UUPU.006

Filesize
7KB

MD5
489d664845e0e001de7e6a87fb355366

SHA1
c0b339c9b8d18dad3b6f425b0eba2833ed313202

SHA256
aab3b216ae3c1415739d487c3d6df9af2b5d055959c289cd803e872b835d55fd

SHA512
7e403f33d0717a3e30664f9702de589c8065690dc423cf69245122e96db346c8112ed15ba53d6ab26c538a1fea9e63dd29a01e2f18be8c1ad439a5466d066be3

Download Submit
C:\Windows\SysWOW64\Sys32\UUPU.007

Filesize
5KB

MD5
8148ef191adcb3a30fbf777b1642dd06

SHA1
79027d2c6b2b14da631a133eeba2a0a102914e39

SHA256
ce5f8b7b0c338711fbc5359ed79c12139c6cdce2a5cdbb53797287800239c2e0

SHA512
8b285260652ce586fc4c8dd8ab26f726634fd50208e9278767461c37f9f4d98857a867322e312ee3b5bcbb9b33d9ff9cb055af7ec9318c2419244c2efcbb2153

Download Submit
C:\Windows\SysWOW64\Sys32\UUPU.009

Filesize
156KB

MD5
3b2537a06b43faa6b0c31cc7ab94177e

SHA1
379fe793ab98b720e3be8fccb047b21265b1adbd

SHA256
b6069dcb916593f22f5c4a71d4898ad8fa6182a4e5f167b8c174a7106396585f

SHA512
f97adc68451627096f68e4c477def5f2deb7791b3a0388cef01e93b81543319843e61463841bd36ff241f93377fde8c147f5f5de6857807247a93882593b8a58

Download Submit
C:\Windows\SysWOW64\Sys32\UUPU.exe

Filesize
475KB

MD5
f7f2f0d8ed270a51c6bce37645b0e8dc

SHA1
3f48aff739c3add1bd951e28c4d11ec24e345adf

SHA256
fa0921f68dec9797bff50e5f3e466c01702eeeff254070c1705ced427edc725b

SHA512
a9c948ad52df9cd83cb4972938b1e1a1751e316d61303eb571ea47e3175d823545ec15951701173f40f1577cc644d1f612e477376730a5fb5d375f2683cc9092

Download Submit
memory/3584-26-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/3584-45-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads