ardamax | 18081790bc35e40a0847e75df2a4ba20d20e8c46e69a4cc39398a1231a0bd310

General

Target

fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe
Size

1.2MB
MD5

fdafc2308715ce40247da1f8ce88f448
SHA1

ea9a5e8e9d87cb9ae403fd50e7e56f2d54e3a66c
SHA256

18081790bc35e40a0847e75df2a4ba20d20e8c46e69a4cc39398a1231a0bd310
SHA512

cad2f30519f2a25ab43507b19249ceb5a768cd37458626bb9573c1ea8cfd64525e0b054bc9b6bd3da9f1227c8794a2cff03db21a1984d1245bbd4df322bd2ac6
SSDEEP

24576:W4C/ikmzV8Lp0JB4n3lGKEhPvZS85OpZ896jXiR6JOaVV1ioLo/sH:cd30Jq1GHhPvZ75h6MWOAV1ioU/sH

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000235a4-13.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	ROTRAD~1.EXE

Executes dropped EXE 3 IoCs

pid	Process
3420	ROTRAD~1.EXE
4996	TAW.exe
4780	ROTRAD~1.EXE

Loads dropped DLL 2 IoCs

pid	Process
4996	TAW.exe
1752	fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TAW Start = "C:\\Windows\\SysWOW64\\SPOTCS\\TAW.exe"	TAW.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SPOTCS\TAW.002	ROTRAD~1.EXE
File created	C:\Windows\SysWOW64\SPOTCS\AKV.exe	ROTRAD~1.EXE
File created	C:\Windows\SysWOW64\SPOTCS\TAW.exe	ROTRAD~1.EXE
File created	C:\Windows\SysWOW64\SPOTCS\TAW.001	ROTRAD~1.EXE
File created	C:\Windows\SysWOW64\SPOTCS\TAW.002	ROTRAD~1.EXE
File created	C:\Windows\SysWOW64\SPOTCS\TAW.exe	ROTRAD~1.EXE
File created	C:\Windows\SysWOW64\SPOTCS\TAW.004	ROTRAD~1.EXE
File created	C:\Windows\SysWOW64\SPOTCS\TAW.004	ROTRAD~1.EXE
File created	C:\Windows\SysWOW64\SPOTCS\AKV.exe	ROTRAD~1.EXE
File created	C:\Windows\SysWOW64\SPOTCS\TAW.001	ROTRAD~1.EXE
File opened for modification	C:\Windows\SysWOW64\SPOTCS\	TAW.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROTRAD~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TAW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROTRAD~1.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4996	TAW.exe
Token: SeIncBasePriorityPrivilege	4996	TAW.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4996	TAW.exe
4996	TAW.exe
4996	TAW.exe
4996	TAW.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3420	1752	fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe	89
PID 1752 wrote to memory of 3420	1752	fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe	89
PID 1752 wrote to memory of 3420	1752	fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe	89
PID 3420 wrote to memory of 4996	3420	ROTRAD~1.EXE	90
PID 3420 wrote to memory of 4996	3420	ROTRAD~1.EXE	90
PID 3420 wrote to memory of 4996	3420	ROTRAD~1.EXE	90
PID 1752 wrote to memory of 4780	1752	fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe	91
PID 1752 wrote to memory of 4780	1752	fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe	91
PID 1752 wrote to memory of 4780	1752	fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdafc2308715ce40247da1f8ce88f448_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ROTRAD~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ROTRAD~1.EXE
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\SysWOW64\SPOTCS\TAW.exe
    "C:\Windows\system32\SPOTCS\TAW.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4996
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ROTRAD~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ROTRAD~1.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:8
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ROTRAD~1.EXE

Filesize
1.2MB

MD5
9327f962fecf5b015b6654f82b691d89

SHA1
a9cb2c42b27a25090ee4b41540e899030a776659

SHA256
3eb068b02bc320ffca11bb5b2c61acf53c81bcab87f189d5ae63f2fff3bccd52

SHA512
3fcdb3bbe500bdfef6f07301c9ccee48cc61d4cd8eaed9fea70ee9cb1faff656ff388dafb2b5bfea624f3b476f254a5c50ba4fedb23655424afbb7168d76978e

Download Submit
C:\Windows\SysWOW64\SPOTCS\AKV.exe

Filesize
456KB

MD5
48cfaed4d566c34716326302b49bdad2

SHA1
566e0989b6bc7ed205f9ae250ea98e3a4d7fba52

SHA256
54c2e10de3ed7135d20c239a7f656c6ff57d1158607fa4c6779e042681de87ea

SHA512
96c871ed9af039142aab5904021d3ef3f75a58c5cc1fdf4d59e40e3699fd03e7cff384b788f7359a1de519ebdcafdad55891fef4f67e2c216ea89ebc945996a0

Download Submit
C:\Windows\SysWOW64\SPOTCS\TAW.001

Filesize
60KB

MD5
a15c556f17d7db8287e023138942d5db

SHA1
880bf8ec944120830dc2e2e040e5996e4e0e6c83

SHA256
f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e

SHA512
930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd

Download Submit
C:\Windows\SysWOW64\SPOTCS\TAW.002

Filesize
43KB

MD5
daabecdfba287a3333b60ae82211acd7

SHA1
e67b4c7bf0dd71ad47263a58bb60be4bce504b84

SHA256
12981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173

SHA512
937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f

Download Submit
C:\Windows\SysWOW64\SPOTCS\TAW.004

Filesize
1KB

MD5
e42c54d6107f4e2e50861bbb05483b33

SHA1
cea8d956168f6b18f1fdc51fc1d0cd3ff09c654d

SHA256
253cbd3d888cc2d241c167fcf7d1e1694fbf0356d367dc963fedaa52845ae4ca

SHA512
a65398c93ce34475529c9f12d288f42759f989eb68b20cfad073afa5eb3a4a9e7570ad678d9c59afe1cc9953186886c4b9d03c38465dad2f7698df00b20f9b51

Download Submit
C:\Windows\SysWOW64\SPOTCS\TAW.exe

Filesize
1.7MB

MD5
f3819a6cab8ae058254c4abb3844d87e

SHA1
0f8b1a74af87f1823ec0d76e21a8d54d55a53a8b

SHA256
3d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9

SHA512
dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads