ardamax | 18a2f3bcd9822ad92bdbca192864bf94b35200b08c17bd90897a1c936f293ee8

General

Target

188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe
Size

1.2MB
MD5

188d3a1d8790c1d8369c78da3781491e
SHA1

39cf7860f88d537eadbc90734f541588118b23b2
SHA256

18a2f3bcd9822ad92bdbca192864bf94b35200b08c17bd90897a1c936f293ee8
SHA512

8ff4f3be1b8c2a5a9cd391e06a63f892fc23ecf23ec18a7b5e7fc896bec73b1d0d9a4c3e1db408eafa0e09287101b799017bff2a6de93d5de94528a518558cc6
SSDEEP

24576:nzwTT6nTyV6vqljo36zEOMYvrpiUJk6Bid98JEmLfc3NBrRLfa+:nz+TIyf0tjUJbidKNIlRL

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016287-10.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
3012	AEJ.exe

Loads dropped DLL 2 IoCs

pid	Process
3000	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe
3012	AEJ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AEJ Start = "C:\\Windows\\SysWOW64\\USATWJ\\AEJ.exe"	AEJ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\USATWJ\AEJ.004	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\USATWJ\AEJ.001	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\USATWJ\AEJ.002	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\USATWJ\AKV.exe	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\USATWJ\AEJ.exe	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\USATWJ\	AEJ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3012	AEJ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3012	AEJ.exe
Token: SeIncBasePriorityPrivilege	3012	AEJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3012	AEJ.exe
3012	AEJ.exe
3012	AEJ.exe
3012	AEJ.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3012	3000	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe	28
PID 3000 wrote to memory of 3012	3000	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe	28
PID 3000 wrote to memory of 3012	3000	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe	28
PID 3000 wrote to memory of 3012	3000	188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\188d3a1d8790c1d8369c78da3781491e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\USATWJ\AEJ.exe
  "C:\Windows\system32\USATWJ\AEJ.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\USATWJ\AEJ.001

Filesize
61KB

MD5
9681d3e1f2c53ad98b8467b3acca33fc

SHA1
04d5d08781f27d6e08ad0262f7325b2be4db7743

SHA256
baecddca15ea6932b9cd4e7f5bae848c3c290660a85c408b898150c6f8fd744e

SHA512
5c6191fb676ace9d1c2ddfd4e98651959ab24b718ab626c343e2bb271d31edd8ba43ed9de528c7832ddcc2137d2424c22bb19f115dc252e1400cfcd3edce2098

Download Submit
C:\Windows\SysWOW64\USATWJ\AEJ.002

Filesize
44KB

MD5
e65e4bdb2c86226589b88f101153c01b

SHA1
731be43621721dba20f0bb74966ea08043ef37fd

SHA256
e8a9477bc04824357c0f0bcc1cb665e1dfb6cf5c05f68517749f6cb11821cec2

SHA512
7700ee197f109a8f2cff2e529715e371e36c1d9924af0bedef9285f76898d3448847af3bff342813b9bd8ca619b7c39b9607150596008ffc6fe68b338f6769cd

Download Submit
C:\Windows\SysWOW64\USATWJ\AEJ.004

Filesize
1KB

MD5
10247da3b7c7cc5efd64934db6a1f2e6

SHA1
55af3941f61112ecb5156f5adbe4a9cf517e94ba

SHA256
de811c033a4ee5a3f8c83e770aecff1362ebcfa2f9b4bbfa3557a7a37bcdb599

SHA512
5fa9e62a40f7941a21df00477028644d48fb58af5217a7d57458e13a5bf0fafde94c928ec952f840681a3022196bce1eadd927d75a3854d661b48e33cd85d301

Download Submit
C:\Windows\SysWOW64\USATWJ\AEJ.exe

Filesize
1.7MB

MD5
9a6a50772539f5a61fefa29c34666223

SHA1
b2b8650d817ef7d86bfef48420e9716f0ffdccce

SHA256
93db12799d366bbb10f28b923188e3f1457b3ec931ddf33ddeb131a80e46f00b

SHA512
eb5f89e6b27981d85dc235edc477a4397d08b9e89d638b0e07301a26ca6e640f12251fdcfe1386df4167a2928bc60959289329531bc7a9e14a232ead22935fed

Download Submit
C:\Windows\SysWOW64\USATWJ\AKV.exe

Filesize
485KB

MD5
42150775d201a85ebc379d21aa253f85

SHA1
fccd7df34e16abaf8d55935016cdb15df8041e06

SHA256
00206ccef9ee8da111cc547c698b7e61736b328de48ac5c307d05f2921ef0b9c

SHA512
4ff3c587a8d88e319acb028829c75ecb3e11c16a62ba9c2090720613c51c6555af698ba8ff75672b405602f196ed1b99dbeb9395bae62aac2140fa31600b36e0

Download Submit
memory/3012-16-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3012-18-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads