ardamax | 0cf0fb26fd8b180f820618ffefb27ee77ccafad08a1fcd8f7920e23b11dc17f3

General

Target
77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe
Size 1.2MB
Sample240727-l1e41avgrd
SHA256 0cf0fb26fd8b180f820618ffefb27ee77ccafad08a1fcd8f7920e23b11dc17f3
MD5 77c3a99c1f481952191e5be167f30652
SHA1 f1f2967b85221f4ed643dd0b717ef4d7318f01f5
SHA512 62fae59789dddcbb90bbe66a93725ef577b1eab3307cb0e3318009ffeb35586e01bb7095186393a268803bbd937217c72f93033c424a1b73f77236d582a9bdf7
SSDEEP 24576:NVaUTOpqR2M9sqRE5FaY7q5K2YfEynMBF4pmoosceeXiNTi/1rHFmm7A:NVrTOYXEzaY7qY2YfEynoF4Ide/NTix
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023502-8.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation	ULJ.exe

Executes dropped EXE 1 IoCs

pid	Process
5048	ULJ.exe

Loads dropped DLL 1 IoCs

pid	Process
5048	ULJ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ULJ Start = "C:\\Windows\\SysWOW64\\NBCDSY\\ULJ.exe"	ULJ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\NBCDSY\	ULJ.exe
File created	C:\Windows\SysWOW64\NBCDSY\ULJ.004	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NBCDSY\ULJ.001	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NBCDSY\ULJ.002	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NBCDSY\AKV.exe	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NBCDSY\ULJ.exe	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ULJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	5048	ULJ.exe
Token: SeIncBasePriorityPrivilege	5048	ULJ.exe
Token: SeIncBasePriorityPrivilege	5048	ULJ.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5048	ULJ.exe
5048	ULJ.exe
5048	ULJ.exe
5048	ULJ.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 5048	4020	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe	86
PID 4020 wrote to memory of 5048	4020	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe	86
PID 4020 wrote to memory of 5048	4020	77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe	86
PID 5048 wrote to memory of 512	5048	ULJ.exe	100
PID 5048 wrote to memory of 512	5048	ULJ.exe	100
PID 5048 wrote to memory of 512	5048	ULJ.exe	100

C:\Users\Admin\AppData\Local\Temp\77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\77c3a99c1f481952191e5be167f30652_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\NBCDSY\ULJ.exe
  "C:\Windows\system32\NBCDSY\ULJ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\NBCDSY\ULJ.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AKV.exe

Path C:\Windows\SysWOW64\NBCDSY\AKV.exe
Size 456KB
SHA256 7b62f4292c1324c6aa08b8da79d19440f47e2da72e2caa8fab6c93b0c4296aba
MD5 924cfca73fb9033f078a0f0621456f3a
SHA1 21c1edeac0a21fa9676362915a63856e7cb59b1a
SHA512 24bf43cf465d9bd6a011c8f8f8cf59b8d26b35406f36ae6dda5ed1e6094f5c2b6a83d0c992be7d6d5129c5e9f3d077dabfee847dad56a883a96d503f5a7ae06b
SSDEEP 6144:y5PzLjzF8gL4oAX5w0Kshavf1D3Z/xV7M/HttEILqmMNVS6XRTCU:cbrF8gsoAJU4If19QOnXVl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ULJ.001

Path C:\Windows\SysWOW64\NBCDSY\ULJ.001
Size 60KB
SHA256 c69bfea6d64eef6169eecfaa3b576c9cb48f8fed190487f9051eeb5b3785af6f
MD5 c9cec63855b65f0d823ac0db81864517
SHA1 03e0c57d0f093ccd1b06ea5f07a127a0eb2587cb
SHA512 df8b021329ae4bdc04c72da289a0cb5c95b90e5a51e048dbb4dbb9a38fbcf4718ba249480dd0920cfb84d4141c97d2c7bbf9bcfef8906d83a8812d5fb376fa9e
SSDEEP 768:7dDwuUv1VdGF8YAMRCyM5rZxX2LEtplJQ3PeDujLvLFiOmin85hoQp:qLPdgsr9XX24rcPeDCzcF55hoQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ULJ.002

Path C:\Windows\SysWOW64\NBCDSY\ULJ.002
Size 43KB
SHA256 9d344f12d5aff2bf16090d875317075f6cc57fac95418d7b7469e51d6b363406
MD5 d718a21bcd75d95744395d6dcf2ef9f2
SHA1 c2e3751640138c3ef8a137038ca6578838fa9073
SHA512 f50267c1db72ecdb5a14bb5c97b2420fdc9e53295f1b87ce5df241c96d0c8654698e6c0fc9bc9bd6cd4feca2d2be650b422727a018a74565df08345d42065abf
SSDEEP 768:pKgaz9WfnXPJjnR+sdh+b6iYYzMFVM3IJaxZ42wJ01GmzwMRxR4E/:cgazE/7pXWzMFVMtZbbGMRv4E
MD5 SHA1 SHA512 SSDEEP

Submit Download

ULJ.004

Path C:\Windows\SysWOW64\NBCDSY\ULJ.004
Size 1KB
SHA256 f39b3e12c5efa63daaa893b8ec8be896d8844082f1fb9f7f02d243adf1afb7f1
MD5 13ddf9614872939968af44f44b8f3dab
SHA1 7169b45af0ee4014b9c8e35eb39f564ce01b5957
SHA512 c21de47fcfb87c6d6f81440c9c7b08f536d5a27256b8c984ecf20acd14e44881334f25fcda3410c823f1ea41e1c05052207284f987a7b0d649b25fac58a29912
MD5 SHA1 SHA512

Submit Download

ULJ.exe

Path C:\Windows\SysWOW64\NBCDSY\ULJ.exe
Size 1.7MB
SHA256 3115b43b33937f05243b3470c917c47d2f79e01ca1bead3e0b150018b4be2b57
MD5 405f59610beaf42b02989637f07cb34a
SHA1 e43ed23cdf65da7f184daa6ce3ba8ad1f743c6e6
SHA512 fcb5206da936d76125806b36c4cea8909902fc1b3c85a23b5d22955d8c3ccc0a27f5f5da49f91015582b5b16e2614d9e129540c0cc6056614212079e0a84b814
SSDEEP 49152:v6hWuSZ8iJFQAiqq3Jw9TApnIZskOxPT2TfFVj:v6hBSZTSAilJp1a
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5048-16-0x00000000005D0000-0x00000000005D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads