ardamax | cff9731943e9a8022b996bf370f898a4ccac3b283dd23deab41fb693704ae192

General

Target

56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe
Size

1.1MB
MD5

56795e24f35888b2c3d1488f2fa48359
SHA1

098845009b8bf9ae8aecd0fac4d2c44f03901a0c
SHA256

cff9731943e9a8022b996bf370f898a4ccac3b283dd23deab41fb693704ae192
SHA512

1d757c1052d144734e7e17190878894bc2aa8b5c7760587398ff994315608a7d1e56e854e8117154ff573773d877b91a3865a8b414faf7c04de2543e2a7d67c9
SSDEEP

24576:kZxTj7huqkszuD23BWQp/Jpvyfdk/POpxq0v7RxE+HUz284phl:kXTsNsiOZRJN+dQOpUmXBcR

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023459-37.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	2.exe

Executes dropped EXE 3 IoCs

pid	Process
1904	1.exe
3424	2.exe
2604	NWY.exe

Loads dropped DLL 2 IoCs

pid	Process
2604	NWY.exe
1904	1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWY Start = "C:\\Windows\\SysWOW64\\LJYQOV\\NWY.exe"	NWY.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
11	sites.google.com
9	sites.google.com
10	sites.google.com

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\LJYQOV\NWY.001	2.exe
File created	C:\Windows\SysWOW64\LJYQOV\NWY.002	2.exe
File created	C:\Windows\SysWOW64\LJYQOV\AKV.exe	2.exe
File created	C:\Windows\SysWOW64\LJYQOV\NWY.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\LJYQOV\	NWY.exe
File created	C:\Windows\SysWOW64\LJYQOV\NWY.004	2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2604	NWY.exe
Token: SeIncBasePriorityPrivilege	2604	NWY.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1904	1.exe
1904	1.exe
1904	1.exe
1904	1.exe
2604	NWY.exe
2604	NWY.exe
2604	NWY.exe
2604	NWY.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1904	4852	56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe	85
PID 4852 wrote to memory of 1904	4852	56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe	85
PID 4852 wrote to memory of 1904	4852	56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe	85
PID 4852 wrote to memory of 3424	4852	56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe	86
PID 4852 wrote to memory of 3424	4852	56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe	86
PID 4852 wrote to memory of 3424	4852	56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe	86
PID 3424 wrote to memory of 2604	3424	2.exe	87
PID 3424 wrote to memory of 2604	3424	2.exe	87
PID 3424 wrote to memory of 2604	3424	2.exe	87

C:\Users\Admin\AppData\Local\Temp\56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\56795e24f35888b2c3d1488f2fa48359_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1904
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\LJYQOV\NWY.exe
    "C:\Windows\system32\LJYQOV\NWY.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
72KB

MD5
306fab489b8294118d84d42b449c1a5e

SHA1
aeca5ffe1b815212d09e2d57a313620118d19f1d

SHA256
18bc1c5fd3e789937017e7d41cbcddc608d14a7c66d16e1282f070b300fcdb8c

SHA512
12794f920a605305579eeef6dcbed81606abd2a5818586bf79ca040f68dbb1918c2817a01ff04d38b0464e86b2ee9792663ae493b007f62bc264bdb9df2c3e37

Download Submit
C:\Users\Admin\AppData\Local\Temp\2.exe

Filesize
1.1MB

MD5
e76f2cce30691d234d0a1ebd48eec7b6

SHA1
798344dd72b3f87acacd4dd429adac8962e8e192

SHA256
7d9f0ee198741e8d4ea5bfc9554feede4464217b82f9022af3b6a896068205c5

SHA512
f38d683b8d1e7a9aac7e34b1ec603296c9ca831552c2d503e05bbf79cff64c743f47dacb282b2d2a1fd368fb95a2fae5af5194cf45211246fddf8a469368fc48

Download Submit
C:\Windows\SysWOW64\LJYQOV\AKV.exe

Filesize
456KB

MD5
1f29b1075a91b3da0ccc0b9c49eece56

SHA1
048e675f087181035aedece9e7b11d065c6355cc

SHA256
4f6825548b32329c3360ed9abb7c0a6809a2c2291cf0bcaac511a9fa32a6336e

SHA512
7e152caf055f57f599ecc1e3a404b540b721b3315d2ba16bff6eb21f03edeb3a06ae185621e3139293612d94210f500f098bd281489ca7f336efd8b5284ee060

Download Submit
C:\Windows\SysWOW64\LJYQOV\NWY.001

Filesize
61KB

MD5
31c866d8e4448c28ae63660a0521cd92

SHA1
0e4dcb44e3c8589688b8eacdd8cc463a920baab9

SHA256
dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1

SHA512
1076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839

Download Submit
C:\Windows\SysWOW64\LJYQOV\NWY.002

Filesize
43KB

MD5
093e599a1281e943ce1592f61d9591af

SHA1
6896810fe9b7efe4f5ae68bf280fec637e97adf5

SHA256
1ac0964d97b02204f4d4ae79cd5244342f1a1798f5846e9dd7f3448d4177a009

SHA512
64cb58fbf6295d15d9ee6a8a7a325e7673af7ee02e4ece8da5a95257f666566a425b348b802b78ac82e7868ba7923f85255c2c31e548618afa9706c1f88d34dc

Download Submit
C:\Windows\SysWOW64\LJYQOV\NWY.004

Filesize
1KB

MD5
04883daf002d1e31229edaf67a763811

SHA1
cfa27de24b3b4f0da96567278babe2a5470130aa

SHA256
927ee45ace88b0049c15086cae86877c2b50206d800a51e14551956fb0968205

SHA512
fd79159a23ee99e8812aa6e8a0e5773c4e02672c21250dba4fcb4bce832e5b0f70e9af0f791d9a4b82379204001859a88386ead719915494af261a7015c40388

Download Submit
C:\Windows\SysWOW64\LJYQOV\NWY.exe

Filesize
1.5MB

MD5
0aaffc12ef1b416b9276bdc3fdec9dff

SHA1
9f38d7cf6241d867da58f89db9ff26544314b938

SHA256
42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b

SHA512
bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c

Download Submit
memory/1904-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1904-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1904-108-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4852-33-0x00007FFF491B0000-0x00007FFF49B51000-memory.dmp

Filesize
9.6MB

Download
memory/4852-0-0x00007FFF49465000-0x00007FFF49466000-memory.dmp

Filesize
4KB

Download
memory/4852-4-0x00007FFF491B0000-0x00007FFF49B51000-memory.dmp

Filesize
9.6MB

Download
memory/4852-3-0x00007FFF491B0000-0x00007FFF49B51000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads