ardamax | ccfec75020f7ac4fdf0e0d78242d6276f3942762dc1cc00e1f01d47af8029903

General

Target

590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe
Size

1.2MB
MD5

590b3b8dba5a76d4eea77dfaba32e6f5
SHA1

d94659eda13d457de156ad28918e1f880572b0db
SHA256

ccfec75020f7ac4fdf0e0d78242d6276f3942762dc1cc00e1f01d47af8029903
SHA512

4101f058050b5429ddc1cd2633d8f745b8168622c0ac2fe88a5420e8d53028df8863c4e8861a802819836144ff88bff52a5129443fb60d1c0a8a858020b5e2ef
SSDEEP

24576:DU4oTmLiJmfbuNYSEIcHhh/zvDsDS1MFMo+DbXw34ukOt0tX1HGMPDM:DULTmewfyxEIcHD642Mo+/Xw8Xg

Score

10^/10

ardamax keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0006000000019371-6.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
1032	TRT.exe
3000	RemoteDll.exe

Loads dropped DLL 3 IoCs

pid	Process
2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe
2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe
2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TRT Start = "C:\\Windows\\SysWOW64\\TYBCJP\\TRT.exe"	TRT.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TYBCJP\TRT.002	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TYBCJP\AKV.exe	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TYBCJP\TRT.exe	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TYBCJP\TRT.004	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TYBCJP\TRT.001	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	RemoteDll.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3000	RemoteDll.exe
3000	RemoteDll.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1032	2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe	30
PID 2072 wrote to memory of 1032	2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe	30
PID 2072 wrote to memory of 1032	2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe	30
PID 2072 wrote to memory of 1032	2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe	30
PID 2072 wrote to memory of 3000	2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe	31
PID 2072 wrote to memory of 3000	2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe	31
PID 2072 wrote to memory of 3000	2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe	31
PID 2072 wrote to memory of 3000	2072	590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\590b3b8dba5a76d4eea77dfaba32e6f5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\TYBCJP\TRT.exe
  "C:\Windows\system32\TYBCJP\TRT.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1032
- C:\Users\Admin\AppData\Local\Temp\RemoteDll.exe
  "C:\Users\Admin\AppData\Local\Temp\RemoteDll.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\TYBCJP\AKV.exe

Filesize
456KB

MD5
48cfaed4d566c34716326302b49bdad2

SHA1
566e0989b6bc7ed205f9ae250ea98e3a4d7fba52

SHA256
54c2e10de3ed7135d20c239a7f656c6ff57d1158607fa4c6779e042681de87ea

SHA512
96c871ed9af039142aab5904021d3ef3f75a58c5cc1fdf4d59e40e3699fd03e7cff384b788f7359a1de519ebdcafdad55891fef4f67e2c216ea89ebc945996a0

Download Submit
C:\Windows\SysWOW64\TYBCJP\TRT.001

Filesize
60KB

MD5
a15c556f17d7db8287e023138942d5db

SHA1
880bf8ec944120830dc2e2e040e5996e4e0e6c83

SHA256
f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e

SHA512
930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd

Download Submit
C:\Windows\SysWOW64\TYBCJP\TRT.002

Filesize
43KB

MD5
daabecdfba287a3333b60ae82211acd7

SHA1
e67b4c7bf0dd71ad47263a58bb60be4bce504b84

SHA256
12981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173

SHA512
937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f

Download Submit
C:\Windows\SysWOW64\TYBCJP\TRT.004

Filesize
1KB

MD5
bce30f37ccfdb824f39194e93c628fb8

SHA1
16c2d5d5947de48e2d9e012201b5c0ba40e86a10

SHA256
7209bdfac4d7bf194cf2442a2a93ff223d4dcae79b18db11c152503c75e43a2d

SHA512
3f8aec73787bc7a7bfd6ed186af9a032362baab2b64ae07a3e08ff11f0f4cc8d468755cad5f3040ba9823898b6be50bc393af33b92dff39802c02ce839bc5d92

Download Submit
\Users\Admin\AppData\Local\Temp\RemoteDll.exe

Filesize
128KB

MD5
5225377ad8c0c280d394c3a445ed7964

SHA1
03aa2d4dbf77c563262d8aa3795cc2363e4dd933

SHA256
63860c8c4067ec09d017f445fdb986c0490c7dbe3e6505fbd2b7b34a9e8a74bd

SHA512
a169345f8d57834d146692bbfd085883a2099963af6b5a5c1dd87d62ab29d0da6b3b190671b4bf8b0cd1b5c331e4281108ba9f02faa22cda4568699463370d9e

Download Submit
\Windows\SysWOW64\TYBCJP\TRT.exe

Filesize
1.7MB

MD5
f3819a6cab8ae058254c4abb3844d87e

SHA1
0f8b1a74af87f1823ec0d76e21a8d54d55a53a8b

SHA256
3d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9

SHA512
dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57

Download Submit
memory/1032-16-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads