ardamax | b2543f07bf1096e8f71e591de87bcc11ed5f6e94b5a661421776d8d1be209ba1

General

Target

18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
Size

577KB
MD5

18f6f25facfe0463e9e7612115ffec26
SHA1

b234cfdd8e864ea215160c50e1327aa4fe96d194
SHA256

b2543f07bf1096e8f71e591de87bcc11ed5f6e94b5a661421776d8d1be209ba1
SHA512

6dc32e64a287de0a8a67105a7a8b059d87b0885234d25452152b99f888e9cf9083625a182c03c8c2c9259e78334cc5a27ba6b0524c8a4fe0c647897aa3c23ce3
SSDEEP

12288:iLlqNGnnORIYGPX0Q59KV7X4WvSywUe0A0:V4n6gPX0Q5mvSyB5A0

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000001686c-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
1300	PGIT.exe

Loads dropped DLL 3 IoCs

pid	Process
2236	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
2236	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
2236	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PGIT Agent = "C:\\Windows\\SysWOW64\\28463\\PGIT.exe"	PGIT.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\AKV.exe	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\PGIT.001	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\PGIT.006	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\PGIT.007	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\PGIT.exe	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PGIT.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1300	2236	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe	28
PID 2236 wrote to memory of 1300	2236	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe	28
PID 2236 wrote to memory of 1300	2236	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe	28
PID 2236 wrote to memory of 1300	2236	18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\28463\PGIT.exe
  "C:\Windows\system32\28463\PGIT.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\AKV.exe

Filesize
411KB

MD5
38defc8742dcd7b684e5ae1193e7e668

SHA1
5710271eb398f63f0f0b209c46460ff9665df9bb

SHA256
b74a277270efc272bef1e264dc11289b7f13c651ac7640745df46bf6792c36d1

SHA512
46cc4b677af570905ac0c36b4e85030a618cefd6e4eb4eb4fc850ad2df45c14233024f0aa655e28649212aa42bf74499a91a682750748f75132aa18d1464cb84

Download Submit
C:\Windows\SysWOW64\28463\PGIT.001

Filesize
494B

MD5
93230ed7b414146c5169479b390677cc

SHA1
7337a42ae60c37625f669e4b511c2b9e3b9cfb55

SHA256
4d7c1d47a4e2f0eb88105958696de54d918da377c2a7ebf110fdd8b3563ac6d2

SHA512
0e241e9a1dc0efbe210041375983777e1c40baf4791b066901a12c8b9ecdc7722a45d3e2ce6b13caa6c85b5248fbd9e61e1fd436911803ec69e62b9ddf97ee56

Download Submit
C:\Windows\SysWOW64\28463\PGIT.006

Filesize
8KB

MD5
e44628a2b8e2044ebb635eed3d5f79d9

SHA1
87120d6466ae60ea0df734c578f371c5c77acf3a

SHA256
6742a87a0df8e620ff5314729c94cfaa738daf172220868cb748b09bb4e72ca4

SHA512
ab1ec2ced331a14d60976338715cb9a09144b784d5c3fbcee139e85f843cab9aaa6627ae7a2f7f9d82cda5297fcc045e97385639397acb252bb18ebf315db37e

Download Submit
C:\Windows\SysWOW64\28463\PGIT.007

Filesize
5KB

MD5
75d6279af7fa9545ba7b7b01a85d2e12

SHA1
2fa39502b0aaa872712068747ff4f0800e955898

SHA256
189a54410440caab60ed99dadf5fed2edcb0d36e5ed3e9a59be41026662bbc0e

SHA512
26c21d6e68fef49d988d4e20da9df164760318087752d4d872275efdc0c667fc31426a916acb8eeb65a0acf20ce3bd3c8953bd34cd83cc46cf44c329469f2ae9

Download Submit
\Users\Admin\AppData\Local\Temp\@868E.tmp

Filesize
4KB

MD5
102f90f4f42551b2acd64923065a2b56

SHA1
18bbbd1a10b603e05816f5a2baf9a6bed74346a3

SHA256
623f4b9a4910c8815d2ab19696668258ff2c30c3adac8967d616f7e60ec619fd

SHA512
2c8338799bcd64083dbe8b0e763424962dd024c52996bae590500b7d844595b539549b6c239f68f3866d5fda9db10808e8e9b489031a1e942bc34277f9a1d9d3

Download Submit
\Windows\SysWOW64\28463\PGIT.exe

Filesize
526KB

MD5
c4e65cee2c8eaf4a4c03852192f49156

SHA1
7c7b416d08056e2ecf215a6ce7126cf74ca3d87e

SHA256
95b5415e32ec93a15a060b6e461151632764cc7693e9d3525e495aa3c9ae1fb0

SHA512
59303381117ced1d99f67fbb10921e34f7ba066edb937ae6e27262941772a48fbe40b861a2954a1e40160b0661f1e2140377ee128ba9600715f6459b65c1bd72

Download Submit
memory/1300-24-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads