ardamax | c11c5c083b2585701fd3aba7908579684e5dd5777b7f6aa0ee2f4d513edff00e

General

Target

2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
Size

622KB
MD5

2621111710e0b9a2cb46c69be7af6854
SHA1

7dc4c7ef5122e8ba1f42b77ea9891e102e53df32
SHA256

c11c5c083b2585701fd3aba7908579684e5dd5777b7f6aa0ee2f4d513edff00e
SHA512

dd700a1c294373a93a1458e635c3f8c5dcd8a204f5552ec0a6677afb15f9238aa13bbc68a851992c1fb07ea571a398adfcabe21374c42d07c5f642a13317ef1e
SSDEEP

12288:Z9uKKaBxbyHDmxwtqeRYlnkWsp3eWfB4kEsx93LTRtbMVoXqyeN2gC:iKpr1yt7RYFLsp3fEuHRNXqy43C

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001660e-9.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2052	JFBC.exe
2712	TibiCAM.exe

Loads dropped DLL 14 IoCs

pid	Process
2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
2052	JFBC.exe
2052	JFBC.exe
2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
2712	TibiCAM.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JFBC Agent = "C:\\Windows\\SysWOW64\\28463\\JFBC.exe"	JFBC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\28463\Language.dat	TibiCAM.exe
File created	C:\Windows\SysWOW64\28463\JFBC.001	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\JFBC.006	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\JFBC.007	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\JFBC.exe	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\28463	JFBC.exe
File created	C:\Windows\SysWOW64\28463\TibiCAM.rtf	TibiCAM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	2712	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JFBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TibiCAM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2052	JFBC.exe
Token: SeIncBasePriorityPrivilege	2052	JFBC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2052	JFBC.exe
2052	JFBC.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2052	2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2052	2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2052	2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2052	2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2712	2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe	32
PID 2336 wrote to memory of 2712	2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe	32
PID 2336 wrote to memory of 2712	2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe	32
PID 2336 wrote to memory of 2712	2336	2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe	32
PID 2712 wrote to memory of 2892	2712	TibiCAM.exe	33
PID 2712 wrote to memory of 2892	2712	TibiCAM.exe	33
PID 2712 wrote to memory of 2892	2712	TibiCAM.exe	33
PID 2712 wrote to memory of 2892	2712	TibiCAM.exe	33

C:\Users\Admin\AppData\Local\Temp\2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2621111710e0b9a2cb46c69be7af6854_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\28463\JFBC.exe
  "C:\Windows\system32\28463\JFBC.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\TibiCAM.exe
  "C:\Users\Admin\AppData\Local\Temp\TibiCAM.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 268
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\AKV.exe

Filesize
393KB

MD5
b0b09699ea39c0107af1c0833f07c054

SHA1
b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1

SHA256
be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1

SHA512
55430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796

Download Submit
C:\Windows\SysWOW64\28463\JFBC.001

Filesize
548B

MD5
77a427bde8d0374be54c6e258b5ee9dc

SHA1
a7a34208ebc327324519d3ba846047f166799594

SHA256
d3f16bdd2c4167a6993219a7a4a3c3aa0dc4aade6a46f749c27277dab7fd25e2

SHA512
62b5965d60d08f4006445295e4c525de685e85689858f27da0ba4d8f4f64a997b631dc440e2924b33e09548efd26d395f1915ec2ccb5326988166a3c4f9f4f3d

Download Submit
C:\Windows\SysWOW64\28463\JFBC.006

Filesize
7KB

MD5
e0fcfa7cad88d1a8a462cee6b06cf668

SHA1
a7e49078517abc929a6da261df06556c8f5a8cf0

SHA256
340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

SHA512
430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

Download Submit
C:\Windows\SysWOW64\28463\JFBC.007

Filesize
5KB

MD5
ca72cd485d116033f1b776903ce7ee0a

SHA1
85b0b73a75b0498f56200dd1a5cf0de5371e42a3

SHA256
e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

SHA512
8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

Download Submit
\Users\Admin\AppData\Local\Temp\@E215.tmp

Filesize
4KB

MD5
908f7f4b0cf93759447afca95cd84aa6

SHA1
d1903a49b211bcb4a460904019ee7441420aa961

SHA256
3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

SHA512
958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

Download Submit
\Users\Admin\AppData\Local\Temp\TibiCAM.exe

Filesize
596KB

MD5
b6e194788efe686f969a02de97e88429

SHA1
84f45bc686e7eba9f3365cbcb1ae3cb5bcef713c

SHA256
1333092038762ffd7ceb1b9808a6102cd04f2961c57ef0bac71dd9e4205e7bab

SHA512
f4ffebb62871b182d4c7a7e6b81a3288394285f4ac22c442629f1bb94574840ef06c7a67b973a0efce45e8983f2f152f56f9a906b4d37e83c931af7c945f48e5

Download Submit
\Windows\SysWOW64\28463\JFBC.exe

Filesize
472KB

MD5
7ca78f42e7c88f01fb7fd88321b283ff

SHA1
8f6fb4e3f5b696cac4fd54490d5f8c1862d0bb6b

SHA256
2354f408b272232ea4bb74d17d22a4332b97f1003fb9bace174a9811f2b41729

SHA512
06e822f04a4657b492a485b5a542e5c8400060abf7e71020d17965fee11f1f7c0807e32b5f9426a4fb9b4d7dd05a68ae871e5fef0807e24204351ebe569eb4ca

Download Submit
memory/2052-23-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2052-39-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2712-38-0x000000007741F000-0x0000000077420000-memory.dmp

Filesize
4KB

Download
memory/2712-45-0x000000007741F000-0x0000000077420000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads