ardamax | 08fa5d1198e9b5f7936e6a013248828398135d578e2d8d81ea017bfa67064840

General

Target

f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe
Size

502KB
MD5

f987aeeddba1b50fdbff67a93c9783f8
SHA1

724102a855cad04df9bb7dac194eadc5a1d1d290
SHA256

08fa5d1198e9b5f7936e6a013248828398135d578e2d8d81ea017bfa67064840
SHA512

0916fa532db316e8da860a21ec8e2d9b06539c31245a2d17733cbf56c697d4dd639a2a0214b234be6cf819cd8318e89ec4084dd8fa6c70eaa998013857d3e326
SSDEEP

12288:qx6MTPwiduA84EXZGvfTLQPJBIsrSfMZloai+d7gzwWQOoCG:IPwsuFZGv7QBI0UYTiNkZRl

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016033-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
1648	NFRD.exe

Loads dropped DLL 3 IoCs

pid	Process
2532	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe
2532	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe
2532	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NFRD Agent = "C:\\Windows\\SysWOW64\\28463\\NFRD.exe"	NFRD.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\NFRD.001	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\NFRD.006	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\NFRD.007	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\NFRD.exe	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NFRD.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1648	2532	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1648	2532	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1648	2532	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1648	2532	f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f987aeeddba1b50fdbff67a93c9783f8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\28463\NFRD.exe
  "C:\Windows\system32\28463\NFRD.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\AKV.exe

Filesize
408KB

MD5
9f298a92f457a6c240b70393f336a17a

SHA1
1acfd6d9856cdd6ca71b6efcc55040e97904aa58

SHA256
557cfe249fa1838dc600ca8b137b1dc2dde3d9552b9ee4186bdca34b0401164e

SHA512
17cb2cc5b337a2b55b94ccc3ce7661fe2b502ce309a012eabfd4d88797a85a3fe3dae53e34891e5b295f7764494836b62a0d24b0b03ac6c93f77cc1f5dd0484c

Download Submit
C:\Windows\SysWOW64\28463\NFRD.001

Filesize
478B

MD5
806061e451e2e88656bdf69202d3380e

SHA1
cf1f93d0f6c5e320a4f062c9abf8812e21e9a507

SHA256
ac09f57900e9d0b86466b4135ddd3623ea1c945bd51000edb796ddf93ed84443

SHA512
729760eddb6c5cc8406e67db7df073d63a2df019d0facb7fb61edf766f84806ed24f0f0cdb188fc354a056a03ddb64f26d6a1d3ba2f5c45b7c8351ac47762c72

Download Submit
C:\Windows\SysWOW64\28463\NFRD.006

Filesize
8KB

MD5
75f215af21ded98ab7a1a2a0ea1f1a30

SHA1
e85649693a178064da1aa4cc7c8e34c92472ba0d

SHA256
af46dca2a4f77f0c977fec74312a41e20bd064bd2ca17bec0f09afd67d7e1e3d

SHA512
1582847dae80134e5272fc1b125d6af13746263601ebc8b540ea5fd3e4fc0a05f6e783c59a6052b971efd15d26d9d55b86345292160e9c79041b7c57f9a74f54

Download Submit
C:\Windows\SysWOW64\28463\NFRD.007

Filesize
5KB

MD5
528f383007234b421e3f1072fae5af11

SHA1
b19c49e17263d940ffa4d46c60a7cf2d03525f09

SHA256
531958a2b1de11d2da2eb8a5409f57c1f31253f79f790473d0efc0ae5567b61f

SHA512
d1813fc77b21ebcdada0cc9c410e533a39a436a038d91cb131bf03c987dab6e7e5b4c99f1a135adde84b4afcbd0a9f0f13931bae3c45c5782d7557fa620b4830

Download Submit
\Users\Admin\AppData\Local\Temp\@CEC4.tmp

Filesize
4KB

MD5
fc0fea286539e5d84ccf49020ca3823b

SHA1
d43711c776edf9a07abed6bb95ed4a0e45e14d52

SHA256
2520256a587481813a5557e54a65f2fca97baee5df333102adfff2dbdabb4828

SHA512
70e1a5ec247d5e3057fe19f7f34b31ee7a79ab16dca73794829d9d81e3ed891881df424f7aa44b9424550574ab61c95d376163b16080aa7cfd61e986e6988ea2

Download Submit
\Windows\SysWOW64\28463\NFRD.exe

Filesize
513KB

MD5
1800b0b263035d94f7bb5e9e70270032

SHA1
c8ba77fa2e414ad11e39a6493e15c078c99d80e6

SHA256
0b15e820894e38d036e75abd442e1cebbfb734c4a50fd0f3adcd3b77211caa5e

SHA512
1431bedcba045f110354c7ec8a34ad5677447aa647581ebc86c25ee38397d2eff4b02d438227144b934ce65b26a2be65c44b761bd4b46518ff44ba6aaf06f29f

Download Submit
memory/1648-24-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads