ardamax | f740547db44521211b8f5fdaf267243e45004c2315e4bc7c84a165d9d3aeaa43

General

Target

fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe
Size

1.1MB
MD5

fe396ab6c1ad631330e75ba662f51525
SHA1

ad01126d540379ec35be64fe973199da2a848fdf
SHA256

f740547db44521211b8f5fdaf267243e45004c2315e4bc7c84a165d9d3aeaa43
SHA512

aa0c071455be41abcc4250bdc57197616e49c9f940dfceeb6eee48ec41e14c65c6713916b71722f4869c99f68301718df7a061ecc6f6bd4fd4a07bc60b90f7c8
SSDEEP

24576:zk/AToBLnzLwnQV7CXLugQE2TwaaJhLECJAnfUzrqE0N:YoTWp7GLTl2Ea0ECenf6rP

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016652-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2884	XNT.exe

Loads dropped DLL 4 IoCs

pid	Process
2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe
2884	XNT.exe
2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe
2332	WINWORD.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XNT Start = "C:\\Windows\\SysWOW64\\WTWOVR\\XNT.exe"	XNT.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WTWOVR\XNT.exe	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WTWOVR\	XNT.exe
File created	C:\Windows\SysWOW64\WTWOVR\XNT.004	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WTWOVR\XNT.001	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WTWOVR\XNT.002	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WTWOVR\AKV.exe	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XNT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2332	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2884	XNT.exe
Token: SeIncBasePriorityPrivilege	2884	XNT.exe
Token: SeIncBasePriorityPrivilege	2884	XNT.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2884	XNT.exe
2884	XNT.exe
2884	XNT.exe
2884	XNT.exe
2332	WINWORD.EXE
2332	WINWORD.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2884	2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2884	2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2884	2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2884	2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe	30
PID 2380 wrote to memory of 2332	2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2332	2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2332	2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe	31
PID 2380 wrote to memory of 2332	2380	fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe	31
PID 2332 wrote to memory of 2660	2332	WINWORD.EXE	33
PID 2332 wrote to memory of 2660	2332	WINWORD.EXE	33
PID 2332 wrote to memory of 2660	2332	WINWORD.EXE	33
PID 2332 wrote to memory of 2660	2332	WINWORD.EXE	33
PID 2884 wrote to memory of 576	2884	XNT.exe	34
PID 2884 wrote to memory of 576	2884	XNT.exe	34
PID 2884 wrote to memory of 576	2884	XNT.exe	34
PID 2884 wrote to memory of 576	2884	XNT.exe	34

C:\Users\Admin\AppData\Local\Temp\fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe396ab6c1ad631330e75ba662f51525_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WTWOVR\XNT.exe
  "C:\Windows\system32\WTWOVR\XNT.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\WTWOVR\XNT.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:576
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Rate Request Form.doc"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Rate Request Form.doc

Filesize
50KB

MD5
c1d1a2b6935173aabb4040c6649e65b0

SHA1
5c4dd25a741d45c8120aef127078d8c421141f36

SHA256
be4a82009588293b98034115ba3993125a5ff417eea9b36073c97fd3b9d34a57

SHA512
d2df057074238465724f64b985e0c90bd4a0e0338c88d6096a0ec98bad7748c957b9ef2f24ddd75b49cbe64bba2c65e1f5a696d330f06d16cc79fc24e8b0a06f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
cc1b04f08565dcb52a7a0eb84f0b39d9

SHA1
14b80f953713c5bd3128b9c1c6ea4776fd4a2c3e

SHA256
d047b5e3bed2200c3a0daf05bd0d08b45e227e64bde75a85b7580c06ad8084e6

SHA512
10363618d3a8205692f885e7a1582c1a2ea2dc74d85ca3f7bde330cdf5796a0a792993beee7cfd30a97a50ae665c1bada1a0a51c9a6a3d8f598925b8747c45a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\SysWOW64\WTWOVR\AKV.exe

Filesize
463KB

MD5
eb916da4abe4ff314662089013c8f832

SHA1
1e7e611cc6922a2851bcf135806ab51cdb499efa

SHA256
96af80e7ba0f3997d59ebcb5ecef619f980d71ca29113e2cd2f2e8adcdea3061

SHA512
d0dbe1d1612982b9cd2a3ed3cbd3e3b5be49237f580f91d5e5d5b6d20ed4dc0babb69a666c19bf4e0f10776a43b9b1dcda91a4cd381ce3705b1795ef9d731c8b

Download Submit
C:\Windows\SysWOW64\WTWOVR\XNT.001

Filesize
61KB

MD5
425ff37c76030ca0eb60321eedd4afdd

SHA1
7dde5e9ce5c4057d3db149f323fa43ed29d90e09

SHA256
70b00b09ae76a7ecfd6680ab22df546b17826755087c069fc87d14895e1a4e24

SHA512
ef5ff97c0d682b6155eff8f92dace1789cf01ca8bca55af1c1d0f2243b5e18bc12a657bb2bb12601b51ef9e1b942f02feb8462644da291fd1b2239c34ef2b59b

Download Submit
C:\Windows\SysWOW64\WTWOVR\XNT.002

Filesize
43KB

MD5
12fb4f589942682a478b7c7881dfcba2

SHA1
a3d490c6cda965708a1ff6a0dc4e88037e0d6336

SHA256
4de0c277800ae36b85a11ed9765f732a73578d4dce053ff7179f96ab776fb60d

SHA512
dd1c6a4ea5bc9698701ec941c4e90fe8dfb0993dc321edc052d1a80cc49bc46be665a85ec678876e698de60cda5dbf1d6279742a16d648f9d18e642a3ea33ddd

Download Submit
C:\Windows\SysWOW64\WTWOVR\XNT.004

Filesize
1KB

MD5
f9d31f49ab0caccf0411c20b816733f9

SHA1
1f66a21c6b22443b78056b285cc928fe226a5d77

SHA256
11e3b99df50c624a793611625a5cdba638d6ffdcddf3b8515a2d2bbb2ebfbfd0

SHA512
4e713438948d30a1720e36a214c2a5cd50a1336933a458ad75fc76a819167b83b0688eaf929a1f8c6c9cf14ce6df2b61e8b3b4b941653b99fb2d0edbb9bc3c3d

Download Submit
C:\Windows\SysWOW64\WTWOVR\XNT.exe

Filesize
1.5MB

MD5
f8530f0dfe90c7c1e20239b0a7643041

SHA1
3e0208ab84b8444a69c8d62ad0b81c4186395802

SHA256
734439c4049ae1a832b4cc5c8d227112106406945d1a7cbb355e11a3f5e356c4

SHA512
5cb01517938789e006e00d69729ae7d73ad480f1ae17a80059bf81ee5d9cebb1263a35732c84f03d742684a650b116b13e6731ca80b0b9cdb3908e5588649399

Download Submit
memory/2332-19-0x000000002F751000-0x000000002F752000-memory.dmp

Filesize
4KB

Download
memory/2332-21-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2332-22-0x0000000070B1D000-0x0000000070B28000-memory.dmp

Filesize
44KB

Download
memory/2332-40-0x0000000070B1D000-0x0000000070B28000-memory.dmp

Filesize
44KB

Download
memory/2332-58-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2884-16-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2884-39-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads