ardamax | 5bb539712bbb9e5913cb1bc30dd8245b497a09c6e7fc8ad72b3ae2fffdcf7c0d

General

Target

7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe
Size

284KB
MD5

7465c78800e4d75be3585180177bdf56
SHA1

b1a10ade45aeecf9911f5821346ed863631bf5c0
SHA256

5bb539712bbb9e5913cb1bc30dd8245b497a09c6e7fc8ad72b3ae2fffdcf7c0d
SHA512

48af884fbca71e9132bf5bee102d6d1b19dc0151af8aadb672ec78b0921f0b120836e85fa6720c8ecb8c2944e0b464d38b7a0db6eb0a2b0f8f9d73a56abf2db6
SSDEEP

6144:Xov6IWIlGAgNNT7FwG7YnQplvWQcaZXf668VTEJzYlq+uNBC0t:YmkgNN/FwcYnQr3ZP668VTkQwBCc

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0003000000017801-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2648	VXPY.exe

Loads dropped DLL 5 IoCs

pid	Process
2084	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe
2084	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe
2084	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe
2648	VXPY.exe
2648	VXPY.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VXPY Agent = "C:\\Windows\\SysWOW64\\28463\\VXPY.exe"	VXPY.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\VXPY.exe	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\28463	VXPY.exe
File created	C:\Windows\SysWOW64\28463\VXPY.001	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\VXPY.006	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\VXPY.007	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VXPY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2648	VXPY.exe
Token: SeIncBasePriorityPrivilege	2648	VXPY.exe
Token: SeIncBasePriorityPrivilege	2648	VXPY.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2648	VXPY.exe
2648	VXPY.exe
2648	VXPY.exe
2648	VXPY.exe
2648	VXPY.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2648	2084	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2648	2084	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2648	2084	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2648	2084	7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe	30
PID 2648 wrote to memory of 1560	2648	VXPY.exe	31
PID 2648 wrote to memory of 1560	2648	VXPY.exe	31
PID 2648 wrote to memory of 1560	2648	VXPY.exe	31
PID 2648 wrote to memory of 1560	2648	VXPY.exe	31

C:\Users\Admin\AppData\Local\Temp\7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7465c78800e4d75be3585180177bdf56_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\28463\VXPY.exe
  "C:\Windows\system32\28463\VXPY.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\VXPY.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\VXPY.001

Filesize
398B

MD5
349e1d919c761c128553b46c74bfb5b0

SHA1
4b1342ff5bac7836096f3d370bf75807b9f017da

SHA256
4ef82429e8bd8910a93920aa57c0a24e112672f84c8d92ee726645b1429d3652

SHA512
e2aeeb553a3a1396a8b72e5611795e4fc9ea2808b05c525f13d3b59d3f0e0c9daaac4138febc976d6d491478e5b358114e18c379af12fd5d963e971fc435618f

Download Submit
C:\Windows\SysWOW64\28463\VXPY.006

Filesize
8KB

MD5
75f215af21ded98ab7a1a2a0ea1f1a30

SHA1
e85649693a178064da1aa4cc7c8e34c92472ba0d

SHA256
af46dca2a4f77f0c977fec74312a41e20bd064bd2ca17bec0f09afd67d7e1e3d

SHA512
1582847dae80134e5272fc1b125d6af13746263601ebc8b540ea5fd3e4fc0a05f6e783c59a6052b971efd15d26d9d55b86345292160e9c79041b7c57f9a74f54

Download Submit
C:\Windows\SysWOW64\28463\VXPY.007

Filesize
5KB

MD5
528f383007234b421e3f1072fae5af11

SHA1
b19c49e17263d940ffa4d46c60a7cf2d03525f09

SHA256
531958a2b1de11d2da2eb8a5409f57c1f31253f79f790473d0efc0ae5567b61f

SHA512
d1813fc77b21ebcdada0cc9c410e533a39a436a038d91cb131bf03c987dab6e7e5b4c99f1a135adde84b4afcbd0a9f0f13931bae3c45c5782d7557fa620b4830

Download Submit
\Users\Admin\AppData\Local\Temp\@8047.tmp

Filesize
4KB

MD5
fc0fea286539e5d84ccf49020ca3823b

SHA1
d43711c776edf9a07abed6bb95ed4a0e45e14d52

SHA256
2520256a587481813a5557e54a65f2fca97baee5df333102adfff2dbdabb4828

SHA512
70e1a5ec247d5e3057fe19f7f34b31ee7a79ab16dca73794829d9d81e3ed891881df424f7aa44b9424550574ab61c95d376163b16080aa7cfd61e986e6988ea2

Download Submit
\Windows\SysWOW64\28463\VXPY.exe

Filesize
513KB

MD5
1800b0b263035d94f7bb5e9e70270032

SHA1
c8ba77fa2e414ad11e39a6493e15c078c99d80e6

SHA256
0b15e820894e38d036e75abd442e1cebbfb734c4a50fd0f3adcd3b77211caa5e

SHA512
1431bedcba045f110354c7ec8a34ad5677447aa647581ebc86c25ee38397d2eff4b02d438227144b934ce65b26a2be65c44b761bd4b46518ff44ba6aaf06f29f

Download Submit
memory/2648-22-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2648-25-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads