ardamax | 645c1366ea4f3e72a0b03b808819c7c5bba9a3b00fb52f6c46cc1b51d7645917

Analysis

max time kernel
124s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe
Size

3.1MB
MD5

ea2cf5f07699b54daa893fcf4f83b9d7
SHA1

bc86e6fa7c955efd2e4c51f4f021dd34cdbbcd5c
SHA256

645c1366ea4f3e72a0b03b808819c7c5bba9a3b00fb52f6c46cc1b51d7645917
SHA512

eac9cda6a6633a81d79e31a36f363d66616908f8dfab596aac593f409352eda6e7770da882291641f059580de44fb796c52ee3ca53aee48c7e3887576553cb9f
SSDEEP

49152:W4tLlpamb2AgiP2Ah/RMOplb0M2SL3p93Ckil:E

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00050000000195c5-54.dat	family_ardamax

Executes dropped EXE 3 IoCs

pid	Process
2140	basura.exe
2728	win86.exe
2248	WLH.exe

Loads dropped DLL 7 IoCs

pid	Process
2328	ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe
2328	ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe
2140	basura.exe
2140	basura.exe
2728	win86.exe
2248	WLH.exe
2964	DllHost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WLH Start = "C:\\Windows\\SysWOW64\\UJHXJT\\WLH.exe"	WLH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\runAPI83 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runAPI68.exe\""	basura.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UJHXJT\WLH.003	win86.exe
File created	C:\Windows\SysWOW64\UJHXJT\WLH.exe	win86.exe
File opened for modification	C:\Windows\SysWOW64\UJHXJT\	WLH.exe
File created	C:\Windows\SysWOW64\UJHXJT\WLH.004	win86.exe
File created	C:\Windows\SysWOW64\UJHXJT\WLH.001	win86.exe
File created	C:\Windows\SysWOW64\UJHXJT\WLH.002	win86.exe
File created	C:\Windows\SysWOW64\UJHXJT\AKV.exe	win86.exe
File created	C:\Windows\SysWOW64\UJHXJT\WLH.chm	win86.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2140 set thread context of 2728	2140	basura.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WLH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	basura.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win86.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2248	WLH.exe
Token: SeIncBasePriorityPrivilege	2248	WLH.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2964	DllHost.exe
2964	DllHost.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2328	ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe
2248	WLH.exe
2248	WLH.exe
2248	WLH.exe
2248	WLH.exe
2964	DllHost.exe
2964	DllHost.exe
2964	DllHost.exe
2964	DllHost.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2140	2328	ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe	29
PID 2328 wrote to memory of 2140	2328	ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe	29
PID 2328 wrote to memory of 2140	2328	ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe	29
PID 2328 wrote to memory of 2140	2328	ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe	29
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2140 wrote to memory of 2728	2140	basura.exe	32
PID 2728 wrote to memory of 2248	2728	win86.exe	33
PID 2728 wrote to memory of 2248	2728	win86.exe	33
PID 2728 wrote to memory of 2248	2728	win86.exe	33
PID 2728 wrote to memory of 2248	2728	win86.exe	33

C:\Users\Admin\AppData\Local\Temp\ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea2cf5f07699b54daa893fcf4f83b9d7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Public\Desktop\basura.exe
  "C:\Users\Public\Desktop\basura.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\win86.exe
    C:\Users\Admin\AppData\Local\Temp\win86.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\UJHXJT\WLH.exe
      "C:\Windows\system32\UJHXJT\WLH.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2248

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\win86.exe

Filesize
4KB

MD5
5e5ecae8b08152c885904cde71c50dad

SHA1
727f24d102ab29be690c783ddc149b3a39430fb6

SHA256
b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541

SHA512
dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\zz.jpg

Filesize
126KB

MD5
f12dbaace156820ee4961431613c0056

SHA1
d0ba9b0e56290877bd71d873bac8a2a19db1c41f

SHA256
142bf9db12c7b5cac2bc7bfa172c00abf6a234c0e846044c8cf889751f8a3b32

SHA512
8879bb8d12be720df883671fa047a2c994e9c18816bb3e2c5777f6b6b3f3485c8bd80bc0c98bdcb289b0ba55db1078ee3d0fe97a2cf5bfc4364d9a293eb44fde

Download Submit
C:\Users\Public\Desktop\f6bko8ue.png

Filesize
69KB

MD5
47e24bbe3a255670acf7f09863a5b9a9

SHA1
505875c3ca5145666ce4d31c696d922eabbb45cb

SHA256
0ecbd30f60cc354902f888c212f25e119c6ae2c339d18acddec51ecdf323189d

SHA512
30d946cda38874f7f58069e32dc1522c2e8111096895be1feaadcf07437039fc245dc5ccb6afb9146d3b62420dd97526d29f9ebcac94c7f5fe19382e3a8a1fe0

Download Submit
C:\Windows\SysWOW64\UJHXJT\AKV.exe

Filesize
456KB

MD5
48cfaed4d566c34716326302b49bdad2

SHA1
566e0989b6bc7ed205f9ae250ea98e3a4d7fba52

SHA256
54c2e10de3ed7135d20c239a7f656c6ff57d1158607fa4c6779e042681de87ea

SHA512
96c871ed9af039142aab5904021d3ef3f75a58c5cc1fdf4d59e40e3699fd03e7cff384b788f7359a1de519ebdcafdad55891fef4f67e2c216ea89ebc945996a0

Download Submit
C:\Windows\SysWOW64\UJHXJT\WLH.001

Filesize
60KB

MD5
a15c556f17d7db8287e023138942d5db

SHA1
880bf8ec944120830dc2e2e040e5996e4e0e6c83

SHA256
f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e

SHA512
930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd

Download Submit
C:\Windows\SysWOW64\UJHXJT\WLH.002

Filesize
43KB

MD5
daabecdfba287a3333b60ae82211acd7

SHA1
e67b4c7bf0dd71ad47263a58bb60be4bce504b84

SHA256
12981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173

SHA512
937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f

Download Submit
C:\Windows\SysWOW64\UJHXJT\WLH.003

Filesize
65KB

MD5
50148e8898154d41dca9bbb93d89b26e

SHA1
0821bb26168c7fc10dbd2dc689bc9fa4d7921a9f

SHA256
3914b3af63db284678a342c124410143ba35926f72ea47c71af7776b50f1f9a2

SHA512
97365b487e9961b06eb7a3d0e26963dc4d1236a3174af6d8287dd2d31db34ece59ec0dd4fb193d2e320cc53a4f83676a64f0069cfbdce19ea9aa3ea2478fe583

Download Submit
C:\Windows\SysWOW64\UJHXJT\WLH.004

Filesize
1KB

MD5
5b14a9b8b162f6898e02d7a6cb907ad2

SHA1
5b55fd3e6155102599eb06fbd209fa4587438b00

SHA256
9258871687985edf3fd80792775b6569213b661061e8b1206ada1a53d3027a58

SHA512
83378e817dcdf87be04cc1668f7d4bcd017d2f47fd92882a49a57cf3d00d40acafa4b7e1b6f90f31268f9c93b891abec4b0940b51758fe17f31af673660312b5

Download Submit
C:\Windows\SysWOW64\UJHXJT\WLH.chm

Filesize
913KB

MD5
686d5d5b14228aed4f28c64905dbc7d3

SHA1
b20c10d76ba0a211f08ea2cdbc91d6df8eb73342

SHA256
963aceba76888e94a6eef9316b83d2396634556abedfd33fdae5392d2c218446

SHA512
eb23e753a8ac7ca37382cb3cccc2957132ac5e6ef02b209360dd4f7c7cdd12495a25066526905d0c8bb0923383a57ab6c79ccd28aca5c05270821d5ace975bae

Download Submit
C:\Windows\SysWOW64\UJHXJT\WLH.exe

Filesize
1.7MB

MD5
f3819a6cab8ae058254c4abb3844d87e

SHA1
0f8b1a74af87f1823ec0d76e21a8d54d55a53a8b

SHA256
3d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9

SHA512
dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57

Download Submit
\Users\Public\Desktop\basura.exe

Filesize
3.0MB

MD5
916e0598bfde24238750fb11209eebf6

SHA1
2c31d9a5dd597ad7dc5f9f97daa0f06e39d658d4

SHA256
8af7100e1206e5d3e6f2cbac3568377b395264ed6ad45ecb13be982925a46db9

SHA512
b63ad7dee823e432de61f8e3ee785209b171f5b5bef101c1b3ad1ac73d4dea6ff590eb864f6a3818b4596828e5deee8ff72b131567acdd9bbcf3154a02e6ed9a

Download Submit
memory/2140-16-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2140-49-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2140-13-0x0000000074481000-0x0000000074482000-memory.dmp

Filesize
4KB

Download
memory/2328-14-0x0000000000370000-0x0000000000372000-memory.dmp

Filesize
8KB

Download
memory/2728-30-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2728-26-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2728-56-0x00000000006F0000-0x00000000006F2000-memory.dmp

Filesize
8KB

Download
memory/2728-57-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2728-28-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2728-32-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2728-39-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2728-34-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2728-37-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2728-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-24-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2964-15-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads