ardamax | 287597cd753fb2bc0daf071f6d746f2cabcbe1da2a4676d720caec50893b8246

General

Target

edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe
Size

1.1MB
MD5

edc19b98b1fcadabd7e50373e08793a0
SHA1

9162a45f137b9a6d82bba7739eeed417db90a413
SHA256

287597cd753fb2bc0daf071f6d746f2cabcbe1da2a4676d720caec50893b8246
SHA512

4d6113756512e535e9d968a089c07d6768e9e67a5859ca8ae60b999f23a6c93330bc752f105e82b456567cd8996b05c5fbc3bfda8b64243cbe4c97036c7ad95b
SSDEEP

24576:tZxTwAlBpQOoZdtneEcYG2EbNGTVyuk5/4dfr/SwTCPs:tXTwEoZiY4NMlA/4dfewT

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234cc-8.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	XWU.exe

Executes dropped EXE 1 IoCs

pid	Process
1644	XWU.exe

Loads dropped DLL 1 IoCs

pid	Process
1644	XWU.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XWU Start = "C:\\Windows\\SysWOW64\\VPYECO\\XWU.exe"	XWU.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\VPYECO\XWU.004	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VPYECO\XWU.001	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VPYECO\XWU.002	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VPYECO\AKV.exe	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VPYECO\XWU.exe	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\VPYECO\	XWU.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	1644	XWU.exe
Token: SeIncBasePriorityPrivilege	1644	XWU.exe
Token: SeIncBasePriorityPrivilege	1644	XWU.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1644	XWU.exe
1644	XWU.exe
1644	XWU.exe
1644	XWU.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1644	1308	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe	82
PID 1308 wrote to memory of 1644	1308	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe	82
PID 1308 wrote to memory of 1644	1308	edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe	82
PID 1644 wrote to memory of 4496	1644	XWU.exe	92
PID 1644 wrote to memory of 4496	1644	XWU.exe	92
PID 1644 wrote to memory of 4496	1644	XWU.exe	92

C:\Users\Admin\AppData\Local\Temp\edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edc19b98b1fcadabd7e50373e08793a0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\VPYECO\XWU.exe
  "C:\Windows\system32\VPYECO\XWU.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\VPYECO\XWU.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\VPYECO\AKV.exe

Filesize
456KB

MD5
a65c554c77c4607a4efdef07b9503fb9

SHA1
4faa215bd772deb3223dac1601972fce2f6c05f1

SHA256
7d32aa95d682ac91df6efa4efc01e5675f69e72fc9821632006111df44e08d7c

SHA512
44be9403aff24e3bdb886a883b7ad8fa06950d969ef1588c4dab43fcc030768d4797fd4ce645ddfe49949d6a97fac5061f2d840ab086b5e43189e5adb441438a

Download Submit
C:\Windows\SysWOW64\VPYECO\XWU.001

Filesize
61KB

MD5
5901282271c72b6effd11d0ec9c17547

SHA1
729945fc0534bd5203dbe02b2dcdf33d0edb84e1

SHA256
395e86709d918c7954ee97baaa34634ede86a2af233ac175c15ae3107f2e9a28

SHA512
05e92fad30ab5d89ebb6eb33fdc76ef9575dbf4c7d649782fd902010a11505a7499b38a4aceccf46e5f8b31617b730a0436cf821442b59dcdeec71ecc2a90a17

Download Submit
C:\Windows\SysWOW64\VPYECO\XWU.002

Filesize
43KB

MD5
c04e0de732e8f56b401e409c4417149c

SHA1
7b260b3600345fb72af9fd0e4025b4a125c8dd08

SHA256
0d359c2c70001f56c14e7e29a12456c82606bb9a46f9db1f8216a9087775dec6

SHA512
d9e2bf02bcb144a8c37e05cb2544ca46fe93e1f2b5a4e08832d533ab9348ddb9153b5c36efa4186d625a80af5d546331d740a13f43c5195ccb4829c98eaa69b0

Download Submit
C:\Windows\SysWOW64\VPYECO\XWU.004

Filesize
1KB

MD5
889dff204d11d99d677b9cd7d3750693

SHA1
f667dc5a95c7ee9116447858da704ec7ae40b383

SHA256
059e2b8f498cfdb280d26bd0184a7d973e4bfc9d5e18d94122c419f1cb6079ff

SHA512
d5cbf683f73142492378af34961b28ae60dcf87049d72a795e13e06c9e88f9ac510009e31ff653ea0a5a2caf2cf719bb4e05362f2e28207e4cd946bf4060b212

Download Submit
C:\Windows\SysWOW64\VPYECO\XWU.exe

Filesize
1.5MB

MD5
82dc38922620ab6a5850f391584d2657

SHA1
ef30f091ff7aa242600f19e87f2b7b0cd7b0764f

SHA256
b464e42b8dfef6629030283e19c20bcc69d6d7c1bf9bb7e8df472f762debcea2

SHA512
4ec72c1d1599721ee1205f46a74a71fb67801e4d7aa6ca55907c2461a03c41cc3e1333e0b4ed9631b92e2310f45bf27cf865a5cc7ee2507e92f58cdb467023e8

Download Submit
memory/1644-16-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/1644-18-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads