ardamax | af0327730169a6f2fd27fdb41dacf53e2c9a3a489715483b7241c1c9cde7d708

General

Target

1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe
Size

1.7MB
MD5

1bece6944736f83e47c2c073d886060d
SHA1

ebaf009a7f43710bc2ccf74879a2f43ecebc1ae3
SHA256

af0327730169a6f2fd27fdb41dacf53e2c9a3a489715483b7241c1c9cde7d708
SHA512

878f49f6bf3101c94c31384166e9c273dc909d3f0ea0ec02723089969d896cf96b6e4ac2bc7255ffbdce5699ca70846405b23edbca8d498bb3d924220f1c0ea3
SSDEEP

49152:dULT1uRLs2umRNbS8z4ccNA7XB+QADujUtmfLFkusVr+VO99qrx4:dCsvbS8z4cvTXQujUt5t+U9g

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000001640a-6.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
3028	AYG.exe

Loads dropped DLL 4 IoCs

pid	Process
2508	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe
3028	AYG.exe
3036	DllHost.exe
2508	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AYG Start = "C:\\Windows\\SysWOW64\\NFFHMC\\AYG.exe"	AYG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\NFFHMC\AYG.001	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NFFHMC\AYG.002	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NFFHMC\AYG.exe	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NFFHMC\AYG.008	AYG.exe
File created	C:\Windows\SysWOW64\NFFHMC\Screen_Oct_07_2024__06_15_21.jpg	AYG.exe
File created	C:\Windows\SysWOW64\NFFHMC\AYG.004	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NFFHMC\AKV.exe	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\NFFHMC\	AYG.exe
File opened for modification	C:\Windows\SysWOW64\NFFHMC\AYG.008	AYG.exe
File created	C:\Windows\SysWOW64\NFFHMC\Screen_Oct_07_2024__06_15_21.html	AYG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AYG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3028	AYG.exe
Token: SeIncBasePriorityPrivilege	3028	AYG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	DllHost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	AYG.exe
3028	AYG.exe
3028	AYG.exe
3028	AYG.exe
3036	DllHost.exe
3036	DllHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 3028	2508	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe	30
PID 2508 wrote to memory of 3028	2508	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe	30
PID 2508 wrote to memory of 3028	2508	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe	30
PID 2508 wrote to memory of 3028	2508	1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bece6944736f83e47c2c073d886060d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\NFFHMC\AYG.exe
  "C:\Windows\system32\NFFHMC\AYG.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3028

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Picture 091.jpg

Filesize
603KB

MD5
2206b9fb8a52e7879473f33d09e2f99a

SHA1
f198d92e0380a152f7d7b63af76d5778441c3274

SHA256
7d855beda2b68340f9efafa1cd600afbf8324d642ab73b4d906bd38d4a6470a2

SHA512
2f8fdff6408d7201c3454d34c6790e82a3bdfe1103eaa46fa054b839fef6f7177572b63c00a937b48eda773d6f1aabf19daca30a908640357438352dc96ba2ec

Download Submit
C:\Windows\SysWOW64\NFFHMC\AKV.exe

Filesize
456KB

MD5
48cfaed4d566c34716326302b49bdad2

SHA1
566e0989b6bc7ed205f9ae250ea98e3a4d7fba52

SHA256
54c2e10de3ed7135d20c239a7f656c6ff57d1158607fa4c6779e042681de87ea

SHA512
96c871ed9af039142aab5904021d3ef3f75a58c5cc1fdf4d59e40e3699fd03e7cff384b788f7359a1de519ebdcafdad55891fef4f67e2c216ea89ebc945996a0

Download Submit
C:\Windows\SysWOW64\NFFHMC\AYG.001

Filesize
60KB

MD5
a15c556f17d7db8287e023138942d5db

SHA1
880bf8ec944120830dc2e2e040e5996e4e0e6c83

SHA256
f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e

SHA512
930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd

Download Submit
C:\Windows\SysWOW64\NFFHMC\AYG.002

Filesize
43KB

MD5
daabecdfba287a3333b60ae82211acd7

SHA1
e67b4c7bf0dd71ad47263a58bb60be4bce504b84

SHA256
12981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173

SHA512
937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f

Download Submit
C:\Windows\SysWOW64\NFFHMC\AYG.004

Filesize
1KB

MD5
837ee3daf90b50af394ca258e89454db

SHA1
66cb2d836aa6624cd651db5bb7db513f9613b70c

SHA256
448eb295aa4fab27d4e52107745cf4bba7b493d6c3d81236eecd7718443b158b

SHA512
bda475dd1a86204b6264a75c69725e18069554f07fb065729a93b90289fcc2928f6468fe492766efe41934ac11096c79bd481aa63a2919de2c6e498594b2be83

Download Submit
C:\Windows\SysWOW64\NFFHMC\AYG.008

Filesize
101KB

MD5
39a45bf233e3e4a67c454d101ef653f4

SHA1
4664a685e8a31dfccdf603f96026969ebc66e022

SHA256
5c7a74792de1a9c73e86b0c1793b66e84572dc524a7e1ff146502aaee540a426

SHA512
4aef5d1bc63f084a633b7a259606d9dee0e8f5e02a86ab674e9444cf1752dd0c4b1fa440d25ca0cdd022419d94f036fa98943a69c85e2ffca7b0818c95225937

Download Submit
\Windows\SysWOW64\NFFHMC\AYG.exe

Filesize
1.7MB

MD5
f3819a6cab8ae058254c4abb3844d87e

SHA1
0f8b1a74af87f1823ec0d76e21a8d54d55a53a8b

SHA256
3d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9

SHA512
dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57

Download Submit
memory/2508-20-0x0000000000980000-0x0000000000982000-memory.dmp

Filesize
8KB

Download
memory/3028-16-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3028-23-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/3036-21-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads