ardamax | c3a9195f011e754d6dee51969cd29769bf6b619215ce3d02562f289e42a1cd15

General

Target
6710a47a92418d07842bc390f46fd528_JaffaCakes118.exe
Size 3.8MB
Sample240723-lp32payhpd
SHA256 c3a9195f011e754d6dee51969cd29769bf6b619215ce3d02562f289e42a1cd15
MD5 6710a47a92418d07842bc390f46fd528
SHA1 7c791deccd1d64dcb4659a6deef1578fd5c1c441
SHA512 1a8c8ea3c72e7cd9c036e358241f83577c9663eb8b9dfd94d08f8356558e23f94043f6631b5435c4cc72cb934e492bb939d420257a6bc61504c9e1eceb1c872c
SSDEEP 98304:lGBzGzP63k0Djl6115PTmE1IGd8oehsw7xZ0kENTO6rWSXJB:lGBMy3kyOF6658oleZ0vNXrWA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234b4-18.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	VSK 3.0.exe

Executes dropped EXE 2 IoCs

pid	Process
4900	VSK 3.0.exe
5048	ETYW.exe

Loads dropped DLL 8 IoCs

pid	Process
4900	VSK 3.0.exe
5048	ETYW.exe
4900	VSK 3.0.exe
4900	VSK 3.0.exe
5048	ETYW.exe
5048	ETYW.exe
4900	VSK 3.0.exe
4900	VSK 3.0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ETYW Agent = "C:\\Windows\\SysWOW64\\28463\\ETYW.exe"	ETYW.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\28463	ETYW.exe
File created	C:\Windows\SysWOW64\28463\ETYW.001	VSK 3.0.exe
File created	C:\Windows\SysWOW64\28463\ETYW.006	VSK 3.0.exe
File created	C:\Windows\SysWOW64\28463\ETYW.007	VSK 3.0.exe
File created	C:\Windows\SysWOW64\28463\ETYW.exe	VSK 3.0.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	VSK 3.0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	6710a47a92418d07842bc390f46fd528_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	VSK 3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5048	ETYW.exe
Token: SeIncBasePriorityPrivilege	5048	ETYW.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1664	OpenWith.exe
5048	ETYW.exe
5048	ETYW.exe
5048	ETYW.exe
5048	ETYW.exe
5048	ETYW.exe
2028	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4900	4740	6710a47a92418d07842bc390f46fd528_JaffaCakes118.exe	86
PID 4740 wrote to memory of 4900	4740	6710a47a92418d07842bc390f46fd528_JaffaCakes118.exe	86
PID 4740 wrote to memory of 4900	4740	6710a47a92418d07842bc390f46fd528_JaffaCakes118.exe	86
PID 4900 wrote to memory of 5048	4900	VSK 3.0.exe	89
PID 4900 wrote to memory of 5048	4900	VSK 3.0.exe	89
PID 4900 wrote to memory of 5048	4900	VSK 3.0.exe	89

C:\Users\Admin\AppData\Local\Temp\6710a47a92418d07842bc390f46fd528_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6710a47a92418d07842bc390f46fd528_JaffaCakes118.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Temp\VSK 3.0.exe
  "C:\Users\Admin\AppData\Local\Temp\VSK 3.0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\28463\ETYW.exe
    "C:\Windows\system32\28463\ETYW.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@ACF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\@ACF9.tmp
Size 4KB
SHA256 3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23
MD5 908f7f4b0cf93759447afca95cd84aa6
SHA1 d1903a49b211bcb4a460904019ee7441420aa961
SHA512 958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d
MD5 SHA1 SHA512

Submit Download

VSK 3.0.exe

Path C:\Users\Admin\AppData\Local\Temp\VSK 3.0.exe
Size 2.1MB
SHA256 9407cd0ffc4a081a2cfbfdffdeb67cdd8636348717d00cef319998019e4317db
MD5 fc6f53d0c0189de5d979ef0ddfbe799e
SHA1 0e01696ac6ef1ab292c97c6cee225699383785c5
SHA512 334160b1cc05af4bf95dffc4ee0921c3589d67b8146e1473d649657303e4a035341de08e3139c5a2f74bdb2df83afe244370a0b0c15848eee9f986371d93ba4c
SSDEEP 49152:kQ98ZfbaYAVF/Hmtpx1crinE271j6Z0ikprNZA2VB9WY6uyH9nkGM8lVC:k3+YEF/AJc+E271/rNZlVPW1hH9nkG7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSK 3.0.rar

Path C:\Users\Admin\AppData\Local\Temp\VSK 3.0.rar
Size 1.7MB
SHA256 8df8ec3539239badd2e0723d6745034faf3bb9047d3e4be4d0431154c162d3c6
MD5 069cbaf27c7990208595ce367717de0f
SHA1 4c3d9b1a28ca0e0b090e24ae22d2d0d58d7deddb
SHA512 d9bc6d38563867eb7e5d2edd230bc1e1b26abcf9cd48e87b6072e6ff67ccc29d8137ca6fbfd1bb02800aa774e78b0ceb9f4ef88093b67b7ff7713797341177f3
SSDEEP 49152:3pmtu8neaE9QAVuKNNTAWZ3pmerpp6Ky4xHb:3GLeao5NNTnZZm0pp6K37
MD5 SHA1 SHA512 SSDEEP

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 393KB
SHA256 be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1
MD5 b0b09699ea39c0107af1c0833f07c054
SHA1 b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1
SHA512 55430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796
SSDEEP 6144:Nd+7R66g6sAj+YqUp6OObjfTVxBeF5O2jxq/WVEN+yeY:v+7R66g6sAqUpAPfjYF5Hw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ETYW.001

Path C:\Windows\SysWOW64\28463\ETYW.001
Size 384B
SHA256 0b02dd42de0fa12b16f6e4f5373793accf71bbb3ad7ce691c50800b01a8ba043
MD5 b0c0fd6d05dce3ef4ed77b5c76d845a1
SHA1 7cf746f2c10607149e61ed7f7eb78458078ed7c3
SHA512 4c01e07cc782f2cbdd84454948ef47f13c41e752559b3abffd2100e475f356fdb396c90367b2c5f5d1cffc702b87379840a59a492105530ab8ae55ddff7bb42d
MD5 SHA1 SHA512

Submit Download

ETYW.006

Path C:\Windows\SysWOW64\28463\ETYW.006
Size 7KB
SHA256 340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4
MD5 e0fcfa7cad88d1a8a462cee6b06cf668
SHA1 a7e49078517abc929a6da261df06556c8f5a8cf0
SHA512 430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82
SSDEEP 96:6EJh3mtXDUMZQ/XyEPXXCYTJ+cwMswHO1yWCj0GMRZQfHY2mIXT6pDE02wPpx:/3mZQliEPXyY1chCCRZU4yD6pg0HBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ETYW.007

Path C:\Windows\SysWOW64\28463\ETYW.007
Size 5KB
SHA256 e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4
MD5 ca72cd485d116033f1b776903ce7ee0a
SHA1 85b0b73a75b0498f56200dd1a5cf0de5371e42a3
SHA512 8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f
SSDEEP 48:6gklbp/EoW0EE/KD4tJ2z5N03Y2E/fIECi1cBaVM+kHT2k:6gS+Die034/AECiRQHT2k
MD5 SHA1 SHA512 SSDEEP

Submit Download

ETYW.exe

Path C:\Windows\SysWOW64\28463\ETYW.exe
Size 472KB
SHA256 c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b
MD5 d7bd4739313a8e2fc9e080b7d0ba13b2
SHA1 808fcbe663bc02780b1d9962873a1e3066d55f05
SHA512 d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398
SSDEEP 6144:jSz+Wqun6c5sP2bTuw3LTFIgPGzoCDbu/gVuNEQhAb:uiWqvP2P7TFITxfb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads