ardamax | 088aa37b82eebd635f062a8e9df3b3085ce2b02f18fc449283dcd2dcef93c05d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_088aa37b82eebd635f062a8e9df3b3085ce2b02f18fc449283dcd2dcef93c05d.exe
Size 495KB
Sample260924-ldp1pasbkc
SHA256 088aa37b82eebd635f062a8e9df3b3085ce2b02f18fc449283dcd2dcef93c05d
MD5 91605def87f9f919264ee46e86cc8856
SHA1 d242b25e7196d18fe5e448b4c1d2f5ee01e1d2a0
SHA512 f8db251790452dd8b1cac3d72f8d026437ff84ee889865fcc8e6115dc55e4c0ab3350950cf8d9103927a527b464b43481520a009055988d0484d7fbf091675b4
SSDEEP 12288:ILe2L65n3O85NGGuc4jCC6R5gYEbm4behvfznNxQm6Zp1:ILeBdTuBUs3DCJ7nNGp1
TLSH
T1FEB423723204C090D88F877097E61B1A79736D49B7779A4F6C09721D17EB1A3DBC2B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery ardamax keylogger persistence stealer

Malware Config

Signatures

Family: Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5e7-23.dat	family_ardamax

Executes dropped EXE 3 IoCs

pid	Process
1300	Services.exe
452	PSSB.exe
3288	PSSB.exe

Loads dropped DLL 7 IoCs

pid	Process
1300	Services.exe
452	PSSB.exe
452	PSSB.exe
452	PSSB.exe
3288	PSSB.exe
3288	PSSB.exe
3288	PSSB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PSSB Agent = "C:\\Windows\\SysWOW64\\28463\\PSSB.exe"	PSSB.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\PSSB.006	Services.exe
File created	C:\Windows\SysWOW64\28463\PSSB.007	Services.exe
File created	C:\Windows\SysWOW64\28463\PSSB.exe	Services.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	Services.exe
File opened for modification	C:\Windows\SysWOW64\28463	PSSB.exe
File created	C:\Windows\SysWOW64\28463\PSSB.001	Services.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_088aa37b82eebd635f062a8e9df3b3085ce2b02f18fc449283dcd2dcef93c05d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSSB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSSB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	452	PSSB.exe
Token: SeIncBasePriorityPrivilege	452	PSSB.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	jaffacakes118_088aa37b82eebd635f062a8e9df3b3085ce2b02f18fc449283dcd2dcef93c05d.exe
452	PSSB.exe
452	PSSB.exe
452	PSSB.exe
452	PSSB.exe
452	PSSB.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1300	3024	jaffacakes118_088aa37b82eebd635f062a8e9df3b3085ce2b02f18fc449283dcd2dcef93c05d.exe	89
PID 1300 wrote to memory of 452	1300	Services.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_088aa37b82eebd635f062a8e9df3b3085ce2b02f18fc449283dcd2dcef93c05d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_088aa37b82eebd635f062a8e9df3b3085ce2b02f18fc449283dcd2dcef93c05d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\Services.exe
  "C:\Users\Admin\AppData\Local\Temp\Services.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\28463\PSSB.exe
    "C:\Windows\system32\28463\PSSB.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:452

C:\Windows\SysWOW64\28463\PSSB.exe
C:\Windows\SysWOW64\28463\PSSB.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@8F51.tmp

Path C:\Users\Admin\AppData\Local\Temp\@8F51.tmp
Size 4KB
SHA256 2daed63cd25eb939ae46c5a1caf7fe07bde609a859720884b51d324ff45fc4f6
MD5 67ce8b2ea53b0aa6ec6213a2b62b9d95
SHA1 e4ac32be20e72d1c12d0ba6919d5fd209a85d009
SHA512 760bef7efb0750d860909f2c92ef2190d7a63b8d07d83ba17997a2cd5c92f509f6c645d86bfbf22c3baff8ebabbf14856f8f4998b9d7132db19785190071c29e
TLSH
T16981653B37C814B3C2875B73219A06EAB654A37053B1442DC9B307071A69DEBEC2C751
MD5 SHA1 SHA512 TLSH

Submit Download

Services.exe

Path C:\Users\Admin\AppData\Local\Temp\Services.exe
Size 479KB
SHA256 b30be3bbf2f77e09eb29cd1bf83fa0e019a07532ff6a102f511eb16ecab440c8
MD5 d1e036d90a7bbc221627746fbfda0173
SHA1 9e60e9277573b2bd73a94bdc37484044d0df7707
SHA512 abce5290724092628560137403b14f8aa910d02746b7f166ceaaf750e27b70065f498c38f828f112dd95eb91d7333645e4498674f12d22e54d4c035bf7d7b83d
SSDEEP 12288:wx5H02CRZzv/kxHfZvw4nKvjaNdJyC3TovbYzJ6K:AH0RZznE5w4nKvGNhGUp
TLSH
T1DEA42362F26416B4C025993332D4CEA1E37E495110FEC1A37F81A92D11BDB239D66FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 393KB
SHA256 e330dedede24e626c90b2894697df4d81228d583203b80775de310dd315f6a9a
MD5 1533823edeb16a2f6130b0eac0a74b1a
SHA1 c00306974e0acda509d547d8947abbd19e848827
SHA512 2d72b0b822de528943348881aa2f0855ef4d306df52f343ebbd8d8b8845da4a79a01efd88c1abf7645e4a72c4069d6d5d4c4d85f1dcd580ac61a9e2657303a87
SSDEEP 6144:FLjv6D4xjP+3r5oYb3bfdqaHF4j1ZL15G+/JVWN4jbDBz:16D4o3r5oqLdZGj17vx
TLSH
T1B784CF00F6D1C0B2C4AB12704D42A7BD9B75FF911B3595E3B7D43E0AA9316E2AE36346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSSB.001

Path C:\Windows\SysWOW64\28463\PSSB.001
Size 422B
SHA256 a8cb7da9ebb8b5c6efd9fff5bf54f9b0952a8d02eceea2266d6d54ad01d81acd
MD5 5603c60b817a37e34a4dafdf3c395d54
SHA1 d6febc9b7ec1926a040f7bba939cb1b5df886969
SHA512 fd537b55056c769aea75cb692295e7e0170e68b57124e20ba68d195577380858d022f23f1e1e9ad019818fd00e4e7449673bc83bef86af2c0342c0f3346bdb23
TLSH
T1AEE0E233B4C894853794B323AAD06D30B68384BCA03F39D8386B0184A447727E0CA3C4
MD5 SHA1 SHA512 TLSH

Submit Download

PSSB.006

Path C:\Windows\SysWOW64\28463\PSSB.006
Size 7KB
SHA256 6f55fcdfbdba9aef5252dfbb9a0f1ac9c83dac472659223ae5a7840484e2d95b
MD5 9bb764979044a263709a095f707fbf7f
SHA1 6a6ff5611d93c860401b165ff85957fbb340f14c
SHA512 a764c11ce03910f372ab7a19f251dbfcd369ad59a7e19b8f1a5825ef44f263d0c693f6bb69332bcb545ea397fc10497cbe4a83402a60971a07bdeb01ce19c057
SSDEEP 96:6rwh3utCJdQmZQLX+20C5RyYLB+cwfUzC1GWCj0KMRZQVLHel2mIXT6pD+w7:qM3ugdEOZC5RyYVAtCmRZuEyD6pyU
TLSH
T12EF1E83123850DB2DBF916F58893363A876B4221AB9180E38B932DD42D561D3FE34F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSSB.007

Path C:\Windows\SysWOW64\28463\PSSB.007
Size 5KB
SHA256 dfd377848164271d02259d4481e7978a12392f71f7bcadaecae247d962127d08
MD5 c14f089be45a2669a608c0cb4b5ed402
SHA1 6c3168f0af173afbc295848ad1bdb480c510097c
SHA512 3c3bc020b74bd76eaa7b5fe577371fef420a62afa9512ef6a0d148b902fe98f8372358ab0f1213e389ad44d52a631ed117a6921be51d66734059cbfdef33ead9
SSDEEP 48:6gklbEEwgQEEiD4XAK2zxN03tk1C2X3VIECi1cBaVM+kHO2K:6gSbDgm03KznKECiRQHO2K
TLSH
T175C18533F3D504F3F65B9272259615E777AAB03047A2040E4DD7116A2A36663CE3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSSB.exe

Path C:\Windows\SysWOW64\28463\PSSB.exe
Size 472KB
SHA256 9ae3fe10cb437ef5f98a8731c63cd21a3a0791d231428bd264422acd4b57268f
MD5 a10c0ee1f0006cd3f58809ee8a6ab81f
SHA1 c4dcb5bffaaea97f7c6d850905a03c001a452d9a
SHA512 ece264bd37989f52bef0446f378b9c7f2d9f8b6af52cf9ba9234540b2a51b3b0faaa7f3e99ee854371a91650105660deeb0748a82d29733b5f69de15ba8a4157
SSDEEP 6144:M6lizWPGoySwbLtb9QAP4z9azFkbqvIxAB//V/N4c8Ab:uzWeLt34pazFkH0b
TLSH
T133A49E0033E1C0B2D0F706B019B7A7655B79BE2217398AC777A46F4A7D706D1AE3A352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-34-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/452-42-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads