ardamax | ef08bdc4fe16a8fb90036629bd48073ef0678b9f7bb4f289cf77271c5efa5755

General

Target

532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe
Size

1.1MB
MD5

532c29f87f3f57e09acd4fcc6d074155
SHA1

f214ffd5488649b0dc89d28505a78163f297c9fd
SHA256

ef08bdc4fe16a8fb90036629bd48073ef0678b9f7bb4f289cf77271c5efa5755
SHA512

21ecd0cf5600417ba1f2c8ff119fab6c868eeef2bef5fb636dec89aed4847a6a606dc04a93a70d6fd8ddba66801db82174dea3f1ddf6a296713791774ef1ce23
SSDEEP

24576:Yk/ATPSCcqZrE/P1aet4l1R5/TX7E/X0Dp7wG:5oTKl4ZvRNTX78X0DpM

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234d3-8.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3328	OGK.exe

Loads dropped DLL 1 IoCs

pid	Process
3328	OGK.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OGK Start = "C:\\Windows\\SysWOW64\\QBRNYC\\OGK.exe"	OGK.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\QBRNYC\AKV.exe	532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\QBRNYC\OGK.exe	532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\QBRNYC\	OGK.exe
File created	C:\Windows\SysWOW64\QBRNYC\OGK.004	532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\QBRNYC\OGK.001	532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\QBRNYC\OGK.002	532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3328	OGK.exe
Token: SeIncBasePriorityPrivilege	3328	OGK.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3328	OGK.exe
3328	OGK.exe
3328	OGK.exe
3328	OGK.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3328	4444	532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe	84
PID 4444 wrote to memory of 3328	4444	532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe	84
PID 4444 wrote to memory of 3328	4444	532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\532c29f87f3f57e09acd4fcc6d074155_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\QBRNYC\OGK.exe
  "C:\Windows\system32\QBRNYC\OGK.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\QBRNYC\AKV.exe

Filesize
466KB

MD5
b554637f5d9c576ff36ba4c5f5cc5d6c

SHA1
de39bda8ee0331f4364a1ebc9c24cd27d8334587

SHA256
4dd1e87c51370e12a14f6b0e9e06de1d8826b6bd0c5b226f41e84c8fc4a4ee9b

SHA512
c482fea49e3750a647752767867faedfcb9012794ea8258569c98c74fb30a3058a0fc046678c1537fc87909d56d4ce7e2a42ef6b65ae2f0a331dafae3ddb5fab

Download Submit
C:\Windows\SysWOW64\QBRNYC\OGK.001

Filesize
61KB

MD5
1226c67cfa7a94fd9181c73535dcd042

SHA1
08bf3926f6f210048f7b5bb7bf2ac81f69412fbb

SHA256
3bbe524ceb3068b241997981b3a04347c03034500beb07ae45da1d6c62dd25c2

SHA512
0ef8a799f6df0960b96f5dfdf378464f1343276ac7410ebbcdecb2964b6906c3d70a5946651ba0e1008ab3686118e2effd74449ed2944b0366757bf2fd57ada0

Download Submit
C:\Windows\SysWOW64\QBRNYC\OGK.002

Filesize
43KB

MD5
b2bcd668abf17ee408d232cc636614b2

SHA1
c354f941121515536c4f0d9ae49ed1a9b28534b4

SHA256
563f5e99f0beb961ecf6a8284bf41fee3e85d6f63cdff1669438f5a2168bfd99

SHA512
ba1be164de5919ae45f4bedfebe7e7799626b457f07b42fc43b8912f2932955833617b45e147e2e4d406f57f57f50c1869aa611db18a569919395e42fa53a702

Download Submit
C:\Windows\SysWOW64\QBRNYC\OGK.004

Filesize
1KB

MD5
9367a351d010c960d942e707ecb417cf

SHA1
3ce782c892fc3f66ce899eacc6ad8543a7d5cc7c

SHA256
44e1380f969b652c795fd2d1b4e62e796feb068afe947144428313f33af12751

SHA512
b360ae2f40d729f6a1a3e4102bc1ea971d0693d1c67d22fbef586f94e235d8dbe6881494e9b4034f063f448836a64987b1651e285b6fd6ab5fd3ff53c176bfe8

Download Submit
C:\Windows\SysWOW64\QBRNYC\OGK.exe

Filesize
1.5MB

MD5
a9ea3f61a57b36cde9953afd91f18d34

SHA1
e7e931b96b6e39b64a2a38d704bbe9561a234cbc

SHA256
accbdc6de9b6b671e6dc5bda9f1f983fbfcaa07467fbf6eabd25b9d5314d82ec

SHA512
0a6a42a772a3afd66233d9d3abb962b3a8cbf3d6e0e719352795b6441a148617dbe788991f0cead29d4b1540726504c9c56bebd9836ae6263b82a121fafd89fc

Download Submit
memory/3328-16-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/3328-18-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads