ardamax | 7c7766b89776c6b0695c17f1570d4c98856aa52d8dda6c295a367ff71d553534

General

Target

47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe
Size

1.2MB
MD5

47bdae3fc43dc861af8c661592b76c54
SHA1

328710ce428f505762be484396c16a5722e582aa
SHA256

7c7766b89776c6b0695c17f1570d4c98856aa52d8dda6c295a367ff71d553534
SHA512

052e9d9e8976ab5cb5b89278038530fe81d12c0935c116bba7d41ffcfae06cf55fba427606b596e00565afee2a1583e2c032f54659b13299eeb9e7a5708b4918
SSDEEP

24576:xITTXB9KIPqWS/3EycPhGvJkG2wcRcG4Ylbi9gO1xuD2zcHSOAv:x6TXB9l5ycXG2niYJiuSOA

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016c6f-6.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
1032	INX.exe

Loads dropped DLL 2 IoCs

pid	Process
3008	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe
1032	INX.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\INX Start = "C:\\Windows\\SysWOW64\\PPUVXB\\INX.exe"	INX.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\PPUVXB\AKV.exe	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PPUVXB\INX.exe	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PPUVXB\	INX.exe
File created	C:\Windows\SysWOW64\PPUVXB\INX.004	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PPUVXB\INX.001	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PPUVXB\INX.002	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1032	INX.exe
1032	INX.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1032	INX.exe
Token: SeIncBasePriorityPrivilege	1032	INX.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1032	INX.exe
1032	INX.exe
1032	INX.exe
1032	INX.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1032	3008	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe	30
PID 3008 wrote to memory of 1032	3008	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe	30
PID 3008 wrote to memory of 1032	3008	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe	30
PID 3008 wrote to memory of 1032	3008	47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47bdae3fc43dc861af8c661592b76c54_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\PPUVXB\INX.exe
  "C:\Windows\system32\PPUVXB\INX.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\PPUVXB\AKV.exe

Filesize
490KB

MD5
21f362e0d289ba822e526fced424c1f2

SHA1
21118c5c57264eb48a0fde577ec06d4cb07a404c

SHA256
7c561dea779006b50d5befeef48a965dbef1c3b807983bb6411adf27a8c87779

SHA512
349459969f00fc06e5cc9479d1e0860b371170ac787bcab03c46e27d3bec7f909d22c8ee76d3e6f75e43a8f73a074a8cf3021a87a86fedcc7af611ea41346399

Download Submit
C:\Windows\SysWOW64\PPUVXB\INX.001

Filesize
61KB

MD5
93c2eac6b4d476a04730266ec1523f8a

SHA1
d53544650a95769d90c89fa90039399cb8d7e054

SHA256
898d4ed4dc6b52db670bf57bd859ae6e1c25230b28a69e7d0e548bae6941cba8

SHA512
9dc516552c08af9600ebabb025bfed1b9a8f16aafbf1cb7530af7254847264399a118a3bbf980e54ad01542fb4c0df55699d207ac44d85bd0eb94067b1a0bae0

Download Submit
C:\Windows\SysWOW64\PPUVXB\INX.002

Filesize
44KB

MD5
92fc2d978e3dcc66dbbe6ddde516dd75

SHA1
2e31d1a209193872fc7f494274b17f582bb137c0

SHA256
a89bebf2e88c1055b1d38bb715a7efeef93c18d5ec1d32a171ae354ccba4087c

SHA512
50d859f3abaf2d2bcf563a0bf0f47b3be0d1ea0f345fc69f5c9a3635d359798c068e4516803c7b8bd0a61b01b3bb1ece0a4703a278144acfa877311317a959ba

Download Submit
C:\Windows\SysWOW64\PPUVXB\INX.004

Filesize
2KB

MD5
f7be01d3b028c06f0fb8ae4496da121c

SHA1
86f8bfa52731cdbab3ab94b38d43035e10801abf

SHA256
4178b630fc5fa2c2e518c4c6c6a869828c8b32f0095751133afc4fa9bccc5c2e

SHA512
46890248ec1e59f727cd495a23c71285e0173910a799fd89b22346cb93c63737e319eb1af6986f85ec0dc5e6e86f6674a5c4543073b6c91ac2bf0e31430f002f

Download Submit
\Windows\SysWOW64\PPUVXB\INX.exe

Filesize
1.7MB

MD5
851f20b20b52b01ee3e1000c89b47c93

SHA1
f46b94a834d6ba980b096747d725bd975d5d0dbc

SHA256
10b92386e4d23ae4fecbe8f5114bf494cf6012d379a1dd694b5130d5900e7651

SHA512
0eedbd7be28f504c87308552c780b9597d19b9cf220e3995f0d6f351ce21cf2a16f9969d4ed22170151373b5e0c8b9fa62b5b3feb7ecf335606d5d0e7ca6761e

Download Submit
memory/1032-15-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1032-17-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads