ardamax | 22b38ee022a7e7e2f55626a236607ce1985dcb049980802216eddce095842e25

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2025 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a2381438830c9dea5950abda8fa2cf4d.exe
Size

1.1MB
MD5

a2381438830c9dea5950abda8fa2cf4d
SHA1

bb97b90003d7ec0e7598b26ff6723b57a8c7ede8
SHA256

22b38ee022a7e7e2f55626a236607ce1985dcb049980802216eddce095842e25
SHA512

37aac29d987e59030f47df263fa4dd3d3dfbab0963b134457cb8b38b45c893fa3d7913f0d8b7e167de73a93f951fd5532f013467e972fe50bff06372318ae157
SSDEEP

24576:FZjyFYRX2KMA9xU2QQ6RAC+UDT3tOSsqW8bSVW5:FEuxca7cRAC+UX3tKqBSc5

Score

10^/10

ardamax discovery keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c7e-26.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Control Panel\International\Geo\Nation	JaffaCakes118_a2381438830c9dea5950abda8fa2cf4d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805940606-1861219160-370298170-1000\Control Panel\International\Geo\Nation	Olly.exe

Executes dropped EXE 2 IoCs

pid	Process
4640	Olly.exe
824	CJPO.exe

Loads dropped DLL 7 IoCs

pid	Process
4640	Olly.exe
824	CJPO.exe
824	CJPO.exe
824	CJPO.exe
1952	cmd.exe
1952	cmd.exe
1952	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\CJPO.exe	Olly.exe
File created	C:\Windows\SysWOW64\28463\key.bin	Olly.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	Olly.exe
File opened for modification	C:\Windows\SysWOW64\28463	CJPO.exe
File created	C:\Windows\SysWOW64\28463\CJPO.001	Olly.exe
File created	C:\Windows\SysWOW64\28463\CJPO.006	Olly.exe
File created	C:\Windows\SysWOW64\28463\CJPO.007	Olly.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a2381438830c9dea5950abda8fa2cf4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olly.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CJPO.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\0	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\FLAGS	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\Version	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\ = "Ejodav.Igikenqi.Ocowo"	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\ = "SPPUI 1.0 Type Library"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\0\win64\	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\TypeLib	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\slui.exe"	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\0\win64	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\FLAGS\ = "0"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\TypeLib\	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\VersionIndependentProgID	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\InprocServer32\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\Version\ = "1.0"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\ProgID\ = "UPnP.UPnPDevice.1"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\Programmable\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\ProgID\	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\Programmable	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\TypeLib\ = "{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\Version\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\InprocServer32\ = "%SystemRoot%\\SysWow64\\upnp.dll"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\0\win32	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\0\win64\ = "C:\\Windows\\SysWow64\\slui.exe"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\VersionIndependentProgID\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\FLAGS\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\VersionIndependentProgID\ = "UPnP.UPnPDevice"	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\InprocServer32	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4076D08-2978-4830-36B8-CC43ED1DA0BD}\ProgID	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\0\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ACEAFCC-12F3-F0E2-CE34-29B838667BFC}\1.0\0\win32\	CJPO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	824	CJPO.exe
Token: SeIncBasePriorityPrivilege	824	CJPO.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
824	CJPO.exe
824	CJPO.exe
824	CJPO.exe
824	CJPO.exe
824	CJPO.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1952	2372	JaffaCakes118_a2381438830c9dea5950abda8fa2cf4d.exe	86
PID 2372 wrote to memory of 1952	2372	JaffaCakes118_a2381438830c9dea5950abda8fa2cf4d.exe	86
PID 2372 wrote to memory of 1952	2372	JaffaCakes118_a2381438830c9dea5950abda8fa2cf4d.exe	86
PID 1952 wrote to memory of 4640	1952	cmd.exe	88
PID 1952 wrote to memory of 4640	1952	cmd.exe	88
PID 1952 wrote to memory of 4640	1952	cmd.exe	88
PID 4640 wrote to memory of 824	4640	Olly.exe	90
PID 4640 wrote to memory of 824	4640	Olly.exe	90
PID 4640 wrote to memory of 824	4640	Olly.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2381438830c9dea5950abda8fa2cf4d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2381438830c9dea5950abda8fa2cf4d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Arquivos de programas\jk.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Arquivos de programas\Olly.exe
    Olly.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\28463\CJPO.exe
      "C:\Windows\system32\28463\CJPO.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Arquivos de programas\Olly.exe

Filesize
896KB

MD5
a4123ae48cffd1eeb6881cdcb3edae9d

SHA1
b368043362d7ccd4065e4ef78639bfd9ac3f7905

SHA256
d56f1f993340b9cf299273eddd4aa5270fbb4cc8422d870d470b45b63bc4a431

SHA512
b22fca4e1cebd02197892ad84f3d2bef0c4802d779ef3bbd3a0ac4d4177814c8936ed3a8b7150ed281a036bb16f7a3e28ce384d698b4821207252ac155bf85bd

Download Submit
C:\Arquivos de programas\jk.bat

Filesize
28B

MD5
fb2ad654057a9889563decebd169baf6

SHA1
eb0eef6aad39e529bc4742bcad615f8f7980e657

SHA256
357424002bbaea2ca847158c4b42bc90860013a04c2178f729f55f626b7a58cb

SHA512
6512fe8c0ff2b32d6aa571ae9350603f35ccaa7283f3c6a843e47320ff191de7b8c5755a5ea71562aacc596e65f4d6c023a7540af6d54b981a0379993008e265

Download Submit
C:\Users\Admin\AppData\Local\Temp\@C4F6.tmp

Filesize
4KB

MD5
ccf39f70a662f70e7cae4cfc81255c44

SHA1
00177d41252c2a5322be8e54567a845217072e2c

SHA256
4c9cca81f2f2d91b636c0ec747e96821749788368c48981bf04accfeb5c2e5d0

SHA512
2cc006d3bd6af737f31707b457caaa267ee1361cfd0afab0be8b74be8587d02b20909962d138e137fe79252e0d112bd3be091a98ba50863520b5bbf21bb9501d

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
457KB

MD5
828586f5f9fd7e6bd99401fe7cece954

SHA1
8eb70f4af2cec3c3dd3ec1491913369e99b7b874

SHA256
02b8379b1838ea70f7f17e0785aaaedb7c721d9b6e262577723bba9492748d0c

SHA512
16b64be59cf9ae403fb3b7e1fc8da98cb2a5db84aef0e352910172796ecf96dcf86a7e16afe78fa7e22b7b6948e8a1fa027da7161d5a0ad98e76175d764ed6a7

Download Submit
C:\Windows\SysWOW64\28463\CJPO.001

Filesize
298B

MD5
d945741b753dc8c65bc3e23811a7de74

SHA1
43b5a06ec39bea29a21e89da8ec8f555ca59f5af

SHA256
5c34c5d27a2e44ad9398d1f30988701300687a9c4d4d9adb97866e1a3456423e

SHA512
410bc2dd4394c9a07572ecb065a2ec189d505e23890328ef5301bb20381bc3e100393da05b6909f0b3e9f54b96df5b1413f4a5d74ec06d2b7c8d1870a6f4c479

Download Submit
C:\Windows\SysWOW64\28463\CJPO.006

Filesize
8KB

MD5
69db8c925f2dd8136d956a086ed1ee41

SHA1
9d0f653cc7ab881eb45fe93490a9c096f2dec6cf

SHA256
984da5476c2c69a779bc99d0901569347cc605a36499e2284706cda3ed6e13f3

SHA512
fa5cedd539dca3631511488aea8bcb7821db1d53452c1b61ee663cb5700bb9919b092593a7f5eb7a3c3a75f801b2980f817de4a66bf8aa51093ced4b30ffd068

Download Submit
C:\Windows\SysWOW64\28463\CJPO.007

Filesize
5KB

MD5
9e9da4c851850726c789bb4b94a41bb3

SHA1
1e2fd71f1d1a3ac15d3c820d8459635cd775cf24

SHA256
94f6502a4e94de0301ae07befd63767a4de35d9b2d2d00687a3130e883ab1963

SHA512
4c60e951056c5773d769a9c88245fc4a597949deb72a1a7546991488e85ffc4ff2a34840ad227595bcdc105cf187207721b57c457ac832ee0159dd0e1d9be063

Download Submit
C:\Windows\SysWOW64\28463\CJPO.exe

Filesize
648KB

MD5
c5ca2c96edc99cf9edf0f861d784209a

SHA1
6cb654b3eb20c85224a4849c4cc30012cabbdbaa

SHA256
0ca27dfe22971bfb19c7f3d6fe03cd398816a88fc50943ba9821fa6b91be7807

SHA512
aeb36bbbf68c7b733ddd856f8f0cdd9548ff597843a22611757c98f69a589035410fecfa692bb83c740823ddae6432d3be5cb66f4309a9d0f5fedeb7b017ff36

Download Submit
C:\Windows\SysWOW64\28463\key.bin

Filesize
106B

MD5
639d75ab6799987dff4f0cf79fa70c76

SHA1
be2678476d07f78bb81e8813c9ee2bfff7cc7efb

SHA256
fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

SHA512
4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

Download Submit
memory/824-32-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/824-50-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2372-38-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4640-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4640-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download