ardamax | 2c877662dc84a6e6045b6ebcf041b7cd7676199f8508540e6e27e495dfe8bbd7

General

Target

1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe
Size

539KB
MD5

1c6a87681a11087c3ae722583bc304d1
SHA1

9461d808b49850e61d12574e1ea75cf0bc5e3eb3
SHA256

2c877662dc84a6e6045b6ebcf041b7cd7676199f8508540e6e27e495dfe8bbd7
SHA512

6492d4dff074abf219dccefd37dafb232d25be8d483b3d9f646389fb707dda6c503388113c67d18accd7c5183eddd691eaa8d87716ec35d49869041ac3a9c622
SSDEEP

12288:SI7a7PtGLEiiNIaL9twSsRDs39Q+8BOSZ1+EeYgJ:MhGAinUtwS0Dse+8lZ1+BJ

Score

10^/10

ardamax keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023269-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4408	BIUU.exe

Loads dropped DLL 1 IoCs

pid	Process
4136	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BIUU Agent = "C:\\Windows\\28463\\BIUU.exe"	BIUU.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\28463\BIUU.exe	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe
File created	C:\Windows\28463\AKV.exe	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe
File created	C:\Windows\28463\BIUU.001	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe
File created	C:\Windows\28463\BIUU.006	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe
File created	C:\Windows\28463\BIUU.007	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4408	4136	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe	101
PID 4136 wrote to memory of 4408	4136	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe	101
PID 4136 wrote to memory of 4408	4136	1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe	101

C:\Users\Admin\AppData\Local\Temp\1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c6a87681a11087c3ae722583bc304d1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\28463\BIUU.exe
  "C:\Windows\28463\BIUU.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@53C8.tmp

Filesize
4KB

MD5
a3f2a0c8758b54c508d85002ff3737ec

SHA1
b0595f373854370f51a7c009b5c9c45e31e279fc

SHA256
c9e4487d83769a9c183aac6933ff71011fe60d86c8cd621b4c7cf7946e096fd3

SHA512
1a74c8bfcd88239cc3655e26516ec937e41162aacf9cf0035aff47292720c7ebe43c0acda15de363a83165dd491e94712e047cb2b9c85b3b21ed520a49ff6db5

Download Submit
C:\Windows\28463\AKV.exe

Filesize
458KB

MD5
1ad787ab2448bfb4e590e605629a42cd

SHA1
7bd9bc5b1432b69a667562ff8d73c5b94e3d5cee

SHA256
ff12e04cba14eacbcfa01f8768cf10cdc7fa3d85de784bf91613201fb9fc2a10

SHA512
93fec56d8267b85a39e7203c5c0b7325dff8ffa4b413e776f3033281aa1a3d91ebee7f0126d5c6da25e561b9f5eea958a7e1fd2cfe56cc393d2c55bce45bea29

Download Submit
C:\Windows\28463\BIUU.001

Filesize
500B

MD5
036f0e248fb87d396e656b18361bca55

SHA1
3acb3da94c6419e5c3659df90acce35772f0f62f

SHA256
0d0e6fcead5f0bf582fc92229bc923deda138b618fbc351f7b4010c5de69b189

SHA512
99b5e4d69ee43a844f4260fc71f12c9bc0f579280b7fcdcfb72d5eb9f27ae6bf252972a4cbe0bdd5faed55edce17af298973557364f7587c22775423d0e2ed83

Download Submit
C:\Windows\28463\BIUU.006

Filesize
8KB

MD5
cae5a21cbfa53add4cf85d76bbd81743

SHA1
ce22bbcee55e8b5469ffe5092c0a390b184af565

SHA256
4039e5c4313f4008e04f7c30deafb3562d70b13497a5a5fb534b0a0b1188444c

SHA512
d4202713ed156e72ad1c1333880d4f239b6c1bdec65692770121c2917bd48ef0aafe978746cfde0e8b16e5ae2f5b5da26c8d84c98ebba17c91c7e6be27442591

Download Submit
C:\Windows\28463\BIUU.007

Filesize
5KB

MD5
dea01b096778e99c05ef8d551df6c60f

SHA1
25a1013de39d99b25191a6f54584a2ab4388b925

SHA256
3fc544757609dbda2746023dff68eacb168aef1e88d1b6413d7de37454a690ba

SHA512
2d1f6b3ca57dce65e1c83aa0ef4ff95624ba99e58410eec4589821d06f7a5124a973610fb1f0e1e7734d9cd60355fad2c1ebafbaf3393c4e991bb797b65b6e34

Download Submit
C:\Windows\28463\BIUU.exe

Filesize
567KB

MD5
22e6eb320911cbf76fb2ffb8fc6e28ed

SHA1
0614486545c6f0ffce441176756d5eced1792463

SHA256
d71fe98e9324868d030f6fa2b3ea0e9f2debe3411c7ba3d4e61441acb01f9989

SHA512
69c7deb360765f6049403e80261db5075df8572a4515f33567c63a25ac2b880c601a9411e138f9b01ac27db23ca8e903b7bc67dcc0dc8ec5214e36b6c71373ad

Download Submit
memory/4408-23-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads