Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/10/2026, 19:51
General
- Target jaffacakes118_Trojan-Dropper.Win32.Small.awz.exe
- Size 395KB
- Sample261009-yk2dhseb36
- SHA256 aa61ee0d2f2bf893e4e19abd0e27161ce439baa884cbca0341cb6b99ed851bcb
Malware Config
Signatures
- Family: Ardamax
A keylogger first seen in 2013.
- Ardamax main executable 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 11 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 5 IoCs
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.awz.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.awz.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Sys32\SDSY.exe"C:\Windows\system32\Sys32\SDSY.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 12363⤵
- Loads dropped DLL
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\Sys32\SDSY.exe > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\###Ran Online Maps###.exe"C:\Users\Admin\AppData\Local\Temp\###Ran Online Maps###.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xte710F.tmpx -y+ -t"C:\Users\Admin\AppData\Local\Temp" "C:\Users\Admin\AppData\Local\Temp\###Ran Online Maps###.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\Sys32\SDSY.exeC:\Windows\SysWOW64\Sys32\SDSY.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 2516 -ip 25161⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
###Ran Online Maps###.exe
@6D95.tmp
xte710F.tmp
SDSY.001
SDSY.006
SDSY.007
SDSY.exe
memory/2516-55-0x0000000000690000-0x0000000000691000-memory.dmp
memory/2516-31-0x0000000000690000-0x0000000000691000-memory.dmp
memory/3280-26-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3280-48-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3280-56-0x0000000000400000-0x0000000000426000-memory.dmp
memory/5312-54-0x0000000000400000-0x000000000047C000-memory.dmp
memory/5312-49-0x0000000000400000-0x000000000047C000-memory.dmp