ardamax | 9700948b9cd57a183120278ff65ab480bb5316be8a1fae280a9c35fd4f9a41c7

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe
Size

1.4MB
MD5

dbae38e59a8c0e1d0dbb7dbb42073e84
SHA1

414d0d2d7a0da87a86b508e32784e59cb6998f90
SHA256

9700948b9cd57a183120278ff65ab480bb5316be8a1fae280a9c35fd4f9a41c7
SHA512

245fbcfe30199ae8315291e21303206d08c284c2695425f213fa447a035bb9734adde288b5d2b258a18132b351346c3f4ebc5083bd29ebcc51b977632ec9f2a9
SSDEEP

24576:R21XC3eYyAPFLpDUlt/vQWhdiw9ohJlkgt3L70VYlIom7y68Iv:8hGyA99Ag8diwehJlaY1mWQv

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000019665-626.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
1672	Install.exe
1696	LRN.exe

Loads dropped DLL 7 IoCs

pid	Process
1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe
1672	Install.exe
1672	Install.exe
1696	LRN.exe
1696	LRN.exe
1696	LRN.exe
1696	LRN.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LRN Start = "C:\\Windows\\SysWOW64\\IXIUXI\\LRN.exe"	LRN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IXIUXI\AKV.exe	Install.exe
File created	C:\Windows\SysWOW64\IXIUXI\LRN.exe	Install.exe
File opened for modification	C:\Windows\SysWOW64\IXIUXI\	LRN.exe
File created	C:\Windows\SysWOW64\IXIUXI\LRN.004	Install.exe
File created	C:\Windows\SysWOW64\IXIUXI\LRN.001	Install.exe
File created	C:\Windows\SysWOW64\IXIUXI\LRN.002	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LRN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe
Token: 33	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe
Token: 33	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe
Token: 33	1672	Install.exe
Token: SeIncBasePriorityPrivilege	1672	Install.exe
Token: 33	1696	LRN.exe
Token: SeIncBasePriorityPrivilege	1696	LRN.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1696	LRN.exe
1696	LRN.exe
1696	LRN.exe
1696	LRN.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1672	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe	30
PID 1300 wrote to memory of 1672	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe	30
PID 1300 wrote to memory of 1672	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe	30
PID 1300 wrote to memory of 1672	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe	30
PID 1300 wrote to memory of 1672	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe	30
PID 1300 wrote to memory of 1672	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe	30
PID 1300 wrote to memory of 1672	1300	dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe	30
PID 1672 wrote to memory of 1696	1672	Install.exe	31
PID 1672 wrote to memory of 1696	1672	Install.exe	31
PID 1672 wrote to memory of 1696	1672	Install.exe	31
PID 1672 wrote to memory of 1696	1672	Install.exe	31
PID 1672 wrote to memory of 1696	1672	Install.exe	31
PID 1672 wrote to memory of 1696	1672	Install.exe	31
PID 1672 wrote to memory of 1696	1672	Install.exe	31

C:\Users\Admin\AppData\Local\Temp\dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dbae38e59a8c0e1d0dbb7dbb42073e84_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.06.22T13.51\Virtual\STUBEXE\@APPDATALOCAL@\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.06.22T13.51\Native\STUBEXE\@SYSTEM@\IXIUXI\LRN.exe
    "C:\Windows\system32\IXIUXI\LRN.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\IXIUXI\AKV.exe

Filesize
456KB

MD5
1f29b1075a91b3da0ccc0b9c49eece56

SHA1
048e675f087181035aedece9e7b11d065c6355cc

SHA256
4f6825548b32329c3360ed9abb7c0a6809a2c2291cf0bcaac511a9fa32a6336e

SHA512
7e152caf055f57f599ecc1e3a404b540b721b3315d2ba16bff6eb21f03edeb3a06ae185621e3139293612d94210f500f098bd281489ca7f336efd8b5284ee060

Download Submit
C:\Windows\SysWOW64\IXIUXI\LRN.001

Filesize
61KB

MD5
31c866d8e4448c28ae63660a0521cd92

SHA1
0e4dcb44e3c8589688b8eacdd8cc463a920baab9

SHA256
dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1

SHA512
1076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839

Download Submit
C:\Windows\SysWOW64\IXIUXI\LRN.002

Filesize
43KB

MD5
093e599a1281e943ce1592f61d9591af

SHA1
6896810fe9b7efe4f5ae68bf280fec637e97adf5

SHA256
1ac0964d97b02204f4d4ae79cd5244342f1a1798f5846e9dd7f3448d4177a009

SHA512
64cb58fbf6295d15d9ee6a8a7a325e7673af7ee02e4ece8da5a95257f666566a425b348b802b78ac82e7868ba7923f85255c2c31e548618afa9706c1f88d34dc

Download Submit
C:\Windows\SysWOW64\IXIUXI\LRN.004

Filesize
1KB

MD5
986ceacfeaae55025eb72f57041c6ae1

SHA1
974c910a8f9e739a418f4e4464d2ac329c7c61cf

SHA256
5ddc433a9aff39748ed10d54c5176cd8cee75a6b35185c8969890ebfa9603df2

SHA512
5f737a4e1b995ec97c8ee28965dea10285af05ecb2587fd201ad5fc46f90f9a89bbf1f2576f5ce6d5122bcb1db8094de8c17c8e0d2137c28900c208299757778

Download Submit
C:\Windows\SysWOW64\IXIUXI\LRN.exe

Filesize
1.5MB

MD5
0aaffc12ef1b416b9276bdc3fdec9dff

SHA1
9f38d7cf6241d867da58f89db9ff26544314b938

SHA256
42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b

SHA512
bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.06.22T13.51\Native\STUBEXE\@SYSTEM@\IXIUXI\LRN.exe

Filesize
17KB

MD5
b2d102413ae31c1a12935f2c9d71ffcb

SHA1
a9137a0bf30642c55b3e2918037a96450c3a29ac

SHA256
71edbf1b1a0887af052aaa7239e514555af5860c150f06870e8cc2937344b192

SHA512
6b024118ddfab353503aa12fb6bb30f58395153741d5481df2055d89e378117c555813f475a288690300887d5a8a65fb1f5f0276ee515cb5c68c7beb31ed2afd

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.06.22T13.51\Virtual\STUBEXE\@APPDATALOCAL@\Temp\Install.exe

Filesize
17KB

MD5
43ff9d47fb6f47855c3ac53ac96ee02b

SHA1
f5f6996507241c708e4d4841b9ee7238501d6bce

SHA256
a8407cb0e16484be4139af5256a7dd0746009d984af065e5083ec3f46e99c906

SHA512
c8c3eb7141d924d89b65d1115bd255e9f8ab044d81a47c73fc43d0d26c7d8b613712c3a52a33889c76c58abd810d0aec2723ccec647acd9d4421a2a0d916cead

Download Submit
memory/1300-54-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-43-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-292-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-309-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-308-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-286-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-280-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-271-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-263-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-241-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-219-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-201-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-187-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-161-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-140-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-64-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-52-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-62-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-60-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-58-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-56-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-185-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-51-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-47-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-45-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-221-0x0000000076FF0000-0x0000000076FF1000-memory.dmp

Filesize
4KB

Download
memory/1300-41-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-39-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-37-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-35-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-33-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-27-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-25-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-23-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-21-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-19-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-17-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-15-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-13-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-11-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-9-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-7-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-5-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-3-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-1-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-0-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-49-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-31-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-307-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download
memory/1300-632-0x00000000005E0000-0x000000000064C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads