ardamax | 184df64aa9a93f40d2353a33b345262d4323cda5257c6c107ad897e10d0d5b8e

General

Target
185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe
Size 1.4MB
Sample240628-b93ljsvcnf
SHA256 184df64aa9a93f40d2353a33b345262d4323cda5257c6c107ad897e10d0d5b8e
MD5 185b8bb2dcf14f9a91cada0c16be475e
SHA1 55cd4ff4243f82ada383112d0286bd802896cd76
SHA512 ee78fc49a868cfc067621678d8bf5ffe49d04eca34d84deb6108909bbeeab1354f9f0705059d9ee238ae80981cb6ad8a397ac8b57beedb596e6019741525c1e3
SSDEEP 24576:93LJTmRE3p9bdwr5sL92pBM1CQHu5Xu8yRoc9F/xITSUeq9RdLCWAuBofkyQEEAt:93tTmRE33Sr5C9KM1CQHygoc/OwquuBb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023416-8.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2812	NJD.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NJD Start = "C:\\Windows\\SysWOW64\\WGXMNB\\NJD.exe"	NJD.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WGXMNB\NJD.001	185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WGXMNB\NJD.002	185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WGXMNB\AKV.exe	185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WGXMNB\NJD.exe	185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WGXMNB\NJD.004	185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2812	3168	185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe	81
PID 3168 wrote to memory of 2812	3168	185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe	81
PID 3168 wrote to memory of 2812	3168	185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\185b8bb2dcf14f9a91cada0c16be475e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\WGXMNB\NJD.exe
  "C:\Windows\system32\WGXMNB\NJD.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\WGXMNB\AKV.exe
Size 489KB
SHA256 5340cf0385c1ccf9a5f01e9bbcb68474d5760c1c60bd87772fbd8a498208a3c5
MD5 0725c70d7b45945089905464a2710dc8
SHA1 a47223eb378919afc8c2a6af6b031bca12eacaae
SHA512 3b95b3c582c2df9a59c2aaa5e9f04ea093dda8b53a7df4b966d46c6f61643e8beed3e3cca0e784301f5f14ea17e2520ecf10dca0ae805e5b31bd51ac94d10888
SSDEEP 12288:OHchU8z/PLfFMG0uXhJcXOQLqAujD2MCY:OHchU2/PbFcEO+QLqnjDCY
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJD.001

Path C:\Windows\SysWOW64\WGXMNB\NJD.001
Size 61KB
SHA256 c31576bdf535d7e087f2e86142b040028791b135404bc30d5a10c3947bbafa1b
MD5 7ee79134ff1c5648b7f7439007f5e211
SHA1 8dedf162924c045b963578990c51f3424f318787
SHA512 0fe604b270c064361b2bce2b0203afd143d42f57646b6f8e9a7c469cc020d4c43dc3da99c2c7436a9d48c92a335040deb4009df26cd2351df80512defc01f046
SSDEEP 768:MbQ7a1AvdPYRSZcnl2vJPVsRJQ2LECNkEgmApPDolCYnHFibK385ZnA:ba1Ci7nsP6LQ24v9PDoUYoh5ZA
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJD.002

Path C:\Windows\SysWOW64\WGXMNB\NJD.002
Size 44KB
SHA256 8cf369255b48195b8ecec1c7bf2e76924641880aa7311e6cf504ca534bbfcd62
MD5 1db8aa9ffda07a5f5559cbf25087147b
SHA1 eea77894bff8e24fb0861159927f67decb629184
SHA512 b9f80191dd8975c2e484eeec1bc7c6212d1b614061e69d96eda87b7a061a78a34de220f22607c3eb1c0fa37f152744a5c8f65a896e2884a9daf969db54a11704
SSDEEP 768:1ghmYKaqu7/fFPYEDmVIuLhCaU9NeIpAo8rZZ012RTMR9ryY:14mYKaqu7l5ibu9NeIW2xR9u
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJD.004

Path C:\Windows\SysWOW64\WGXMNB\NJD.004
Size 1KB
SHA256 5ba08aed39b8fc04b730f7570e058dbe0faf3fa02066bbaa026dc3ff446d6b9a
MD5 1b56fd9444878db9a5c90b4e5c46fdc8
SHA1 666d9e7eb853ab1be72eab8abc7cdd5d020a799f
SHA512 de170f5de23ed81b393b289d88a9573017bc085f9d9394a6ab7a72765103e0a60d16076585c755909b9868d4696a337a771d7415da363622abb795c5cec84e9c
MD5 SHA1 SHA512

Submit Download

NJD.exe

Path C:\Windows\SysWOW64\WGXMNB\NJD.exe
Size 1.7MB
SHA256 618fb51d23c0ca116dbd24dc5e0240ebda862e405283d64871549321fde08202
MD5 7dc8f94e34ad6f38e94f957043c39617
SHA1 081a26dc478bd3de6f2889b9c8da8b2e79723d8b
SHA512 539c239670369f34e7907d072bdf6b91becb927454db3212b0c307363289b1900edffa2f9fac22d3d14435fcee28b7bdeee1f039f027d74f84627c85774b9f56
SSDEEP 49152:AJIJrr172mvFg5QzV2Fuk/TGpnkZNCAb8i49C5:AWJrrbNg5E2iaZbL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2812-17-0x0000000000620000-0x0000000000621000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads