ardamax | 02c9cc421b0bb69fde124f42cd838a207f3f2deee4d06ff71ee6c3342982d85b

General

Target
3a083df30fff546454a0d6ab2c665c69_JaffaCakes118.exe
Size 149KB
Sample240711-vrcf7aydpd
SHA256 02c9cc421b0bb69fde124f42cd838a207f3f2deee4d06ff71ee6c3342982d85b
MD5 3a083df30fff546454a0d6ab2c665c69
SHA1 a46277d705c45a5395d8028f7ae816e432e9f26a
SHA512 c01a0b980d071c7d97ca8490d8bc3277214fa3f209aee80cad8c7ff002973c5dab204c9a33c83afb9ad64a7e331dc86c9434a56b6284598c7352a918b3a777f0
SSDEEP 3072:TOyPfgXqSFiv7WIyPYO0N29TrxbUVfg4YpHg0hZcmBoycX/P5zZbimCSOMP0KC:bURFi6TQUTrxbsg4sHg0hZubX5zZ1C5Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234b9-21.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	3a083df30fff546454a0d6ab2c665c69_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	~D3BB.exe

Executes dropped EXE 2 IoCs

pid	Process
2280	~D3BB.exe
3724	iexplorer.exe

Loads dropped DLL 4 IoCs

pid	Process
2280	~D3BB.exe
3724	iexplorer.exe
3724	iexplorer.exe
3724	iexplorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iexplorer.001	~D3BB.exe
File created	C:\Windows\SysWOW64\iexplorer.006	~D3BB.exe
File created	C:\Windows\SysWOW64\iexplorer.007	~D3BB.exe
File created	C:\Windows\SysWOW64\iexplorer.exe	~D3BB.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64	iexplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3724	iexplorer.exe
Token: SeIncBasePriorityPrivilege	3724	iexplorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3724	iexplorer.exe
3724	iexplorer.exe
3724	iexplorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2280	4616	3a083df30fff546454a0d6ab2c665c69_JaffaCakes118.exe	86
PID 4616 wrote to memory of 2280	4616	3a083df30fff546454a0d6ab2c665c69_JaffaCakes118.exe	86
PID 4616 wrote to memory of 2280	4616	3a083df30fff546454a0d6ab2c665c69_JaffaCakes118.exe	86
PID 2280 wrote to memory of 3724	2280	~D3BB.exe	87
PID 2280 wrote to memory of 3724	2280	~D3BB.exe	87
PID 2280 wrote to memory of 3724	2280	~D3BB.exe	87

C:\Users\Admin\AppData\Local\Temp\3a083df30fff546454a0d6ab2c665c69_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a083df30fff546454a0d6ab2c665c69_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\~D3BB.exe
  "C:\Users\Admin\AppData\Local\Temp\~D3BB.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\iexplorer.exe
    "C:\Windows\system32\iexplorer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@D59F.tmp

Path C:\Users\Admin\AppData\Local\Temp\@D59F.tmp
Size 4KB
SHA256 477f789ffe931ee11197de814231fdc770e6e6c1e94b0fec5bee0adecd32dd03
MD5 de3f9e4f680ff22e8712fa9b32ff85ee
SHA1 0cc885ed6502b3b610af57ee2095410751d9dd78
SHA512 daf04bb16fec1130dc08e72b7f28b0041b2eb78900e1464e15f1e20e1705a0de24d3df0de8111a42aed03d73db6f8eb5e30c87f34b4a745d4aa27d84e09d9f90
MD5 SHA1 SHA512

Submit Download

~D3BB.exe

Path C:\Users\Admin\AppData\Local\Temp\~D3BB.exe
Size 144KB
SHA256 1c5fb59c9f3981707658b436cdcf287f352010943b99c7e2222f4fc082649eb5
MD5 bff4c68f1600e1824c48f0c34f1c173d
SHA1 428ed29d52c22fbe6f12ac2a07d1b3400fc2fc88
SHA512 3e58f71dd9ecbb783b9a3df59cbe027369d2a19bc46979e6a6430020a1c6fc619aa8a4409a6f353928c612229d7aa748a3c435254d8248a53c96bf9f5280af59
SSDEEP 3072:oOyPfgXqSFiv7WIyPYO0N29TrxbUVfg4YpHg0hZcmBoycX/P5zZbimCSOMP0Kk:KURFi6TQUTrxbsg4sHg0hZubX5zZ1C5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

iexplorer.001

Path C:\Windows\SysWOW64\iexplorer.001
Size 1KB
SHA256 8624086019d85cefafc8530b8a19dd66f6b362a70c747e547abba7853d23d956
MD5 4f9026bf9598201078156cc012423d00
SHA1 48554bd8705c4d4452a522a097b52a48c230f815
SHA512 d788525243af3b0b4edcee3c8c755441a5b25917b3df643933320015bc4f7ae90bd28dc6dba0b30e68d6b057a7d94372d5d56022df5d93fd8a7d679e42b10217
MD5 SHA1 SHA512

Submit Download

iexplorer.006

Path C:\Windows\SysWOW64\iexplorer.006
Size 4KB
SHA256 3b2700a8033916afd0e89ab5519702720f35b94a570ebe865df113f2aacda16c
MD5 1153fe5fbe61266713539cae72d87ad3
SHA1 245047d3d158f4eda34290ed22e4bb13a28f9539
SHA512 24058cdebaf8ccfc00622301927b221116b846c2a8acf8f0935ba30e0d716bfecd6ab07aaf8d93030ec2149ee98eec5f6d2395ee8a1a62ad00e07124447c107c
SSDEEP 48:ai+n/3IfmxnChbP4LzohfO55+AAc+NJGrijq:Qn/1shbezXL+AAcSwr5
MD5 SHA1 SHA512 SSDEEP

Submit Download

iexplorer.007

Path C:\Windows\SysWOW64\iexplorer.007
Size 6KB
SHA256 48cabcd5da354d4018809d12ca445c4c6324250f22450aca04222c214b9ae42d
MD5 049989542b610261bde51aff6b71d4aa
SHA1 22de68b6548faf1ec1b52f14a1f197fa5152babd
SHA512 8cc0cb8167598e50a91230061cbe12d0d724151dc454f6cf0dcd5074efc704602796a9a136e53f609a6d54ad6c468aff2db263ad72b4b7d7febd32656eece34c
SSDEEP 96:Um59JuAtqDsKVbpNsIGNgDLYJ/hdvvJ969J2+s8VHPnf:UmEAtqYOFNDG6DLYR/az2+vtPf
MD5 SHA1 SHA512 SSDEEP

Submit Download

iexplorer.exe

Path C:\Windows\SysWOW64\iexplorer.exe
Size 231KB
SHA256 f3cbf3dd3f229f6119a8be5357959b77af1a43f9d568a7febe9a06f7593b20ed
MD5 79c6903c4794af027053331946137b26
SHA1 b688916709014fc874c5b7870553105a9961c652
SHA512 ac28813dcdc38ff1b0736b1673ced7e35d7da5667b0224b88952908564373ae61aff1b0f03d27e40b613559c8d4e37c402269791db2ed1311f62d069a2e5111e
SSDEEP 3072:MPPARFB6mhJmiL1qlYp59IGLZRABmSJoc5/lQ0ixq0YWrecpqlKNb/aGb:06/h0C4656GL0fD/T10bxZkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4616-8-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads