ardamax | e52f5448095cfeaa24c8f3406aee226b532bd170f189156980f5f8570135a0ce

General

Target

2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
Size

653KB
MD5

2f94542b92520a0ef76122bedf32eb06
SHA1

ce15c37518fb3385960f62a12a8296e5c56ef501
SHA256

e52f5448095cfeaa24c8f3406aee226b532bd170f189156980f5f8570135a0ce
SHA512

aa868971d35960ac932c8071393d0aa47a0dcd70476f7e6607514adca018972a772fc2fd7184ff02f232fa24d01496b06eea5c83afab6cc0957a4b91a86a2acb
SSDEEP

12288:Autrzh9xOXkj4JVZKJVZxO1hubU8ZWucw6LxexMLOP9t:Autr5OUj4JrKJrxUhubUey8xLPv

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00060000000195c8-15.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2592	JYXV.exe

Loads dropped DLL 4 IoCs

pid	Process
2568	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
2568	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
2592	JYXV.exe
2592	JYXV.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JYXV Agent = "C:\\windows\\SysWOW64\\JYXV.exe"	JYXV.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\JYXV.002	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File created	C:\windows\SysWOW64\JYXV.005	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File created	C:\windows\SysWOW64\JYXV.exe	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File created	C:\windows\SysWOW64\JYXV.001	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File created	C:\windows\SysWOW64\JYXV.002	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File opened for modification	C:\windows\SysWOW64\JYXV.exe	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File created	C:\windows\SysWOW64\JYXV.006	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File opened for modification	C:\windows\SysWOW64\JYXV.005	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File opened for modification	C:\windows\SysWOW64\JYXV.007	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File created	C:\windows\SysWOW64\JYXV.008	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File opened for modification	C:\windows\SysWOW64\JYXV.001	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File created	C:\windows\SysWOW64\__tmp_rar_sfx_access_check_259435746	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File created	C:\windows\SysWOW64\JYXV.007	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File opened for modification	C:\windows\SysWOW64\JYXV.008	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
File opened for modification	C:\windows\SysWOW64\JYXV.006	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64	JYXV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JYXV.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2592	JYXV.exe
Token: SeIncBasePriorityPrivilege	2592	JYXV.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2592	JYXV.exe
2592	JYXV.exe
2592	JYXV.exe
2592	JYXV.exe
2592	JYXV.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2592	2568	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2592	2568	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2592	2568	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2592	2568	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2592	2568	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2592	2568	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe	30
PID 2568 wrote to memory of 2592	2568	2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f94542b92520a0ef76122bedf32eb06_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568
- C:\windows\SysWOW64\JYXV.exe
  "C:\windows\system32\JYXV.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\windows\SysWOW64\JYXV.001

Filesize
2KB

MD5
9ee7f1db2ddf138b3723361b623410ef

SHA1
ecc0f750b68ca8f7d9da28fbe472e8af75b2e100

SHA256
0540b49a9957c749dcd99bc5eba3af5fcd94c35c31c5f16c65c1f476646eff7f

SHA512
853416bf4c4b7b1cab7d00042070d86f899787eb453afad600cd0ee2f9e76a394d6d395cddd9f6a970f082887d27832edd33b8de49249755cef5215177d8d1e1

Download Submit
C:\windows\SysWOW64\JYXV.002

Filesize
466B

MD5
95371670235057755f98fa8c1ac0bd30

SHA1
63d5575eb473ce84503fde7c7b09b892ab52944f

SHA256
041e92ec1dc44db7b1646e65c69c36cabea7934b5eadfb7ef5692a59ab67be4c

SHA512
a4b048eb45448fe34a33d29177dc4301d2fb2fce15d7525d88bf30aefd59fc3f05c049cab29c6827f631127618a61263b9a3ee59a34e104f62acb2d4787ed646

Download Submit
C:\windows\SysWOW64\JYXV.006

Filesize
8KB

MD5
e44628a2b8e2044ebb635eed3d5f79d9

SHA1
87120d6466ae60ea0df734c578f371c5c77acf3a

SHA256
6742a87a0df8e620ff5314729c94cfaa738daf172220868cb748b09bb4e72ca4

SHA512
ab1ec2ced331a14d60976338715cb9a09144b784d5c3fbcee139e85f843cab9aaa6627ae7a2f7f9d82cda5297fcc045e97385639397acb252bb18ebf315db37e

Download Submit
C:\windows\SysWOW64\JYXV.008

Filesize
18KB

MD5
70e1db3db2f6d7db855f256aa9ee204e

SHA1
da7abdcc64a694ed201b44330a95e8d1a5617770

SHA256
9f1ecd34f2a628d67b5849b66fe7a384529c4e073e237df0580261e796878aaa

SHA512
3d6ecc78d619a065562fc0ef231309c2171d32bfc69b9d7dfc36684b723a34f13ca698d44daed516279138e3cbd8cce537e8591a36415b3a49ab5dfea226bab1

Download Submit
\Windows\SysWOW64\JYXV.007

Filesize
5KB

MD5
75d6279af7fa9545ba7b7b01a85d2e12

SHA1
2fa39502b0aaa872712068747ff4f0800e955898

SHA256
189a54410440caab60ed99dadf5fed2edcb0d36e5ed3e9a59be41026662bbc0e

SHA512
26c21d6e68fef49d988d4e20da9df164760318087752d4d872275efdc0c667fc31426a916acb8eeb65a0acf20ce3bd3c8953bd34cd83cc46cf44c329469f2ae9

Download Submit
\Windows\SysWOW64\JYXV.exe

Filesize
526KB

MD5
c4e65cee2c8eaf4a4c03852192f49156

SHA1
7c7b416d08056e2ecf215a6ce7126cf74ca3d87e

SHA256
95b5415e32ec93a15a060b6e461151632764cc7693e9d3525e495aa3c9ae1fb0

SHA512
59303381117ced1d99f67fbb10921e34f7ba066edb937ae6e27262941772a48fbe40b861a2954a1e40160b0661f1e2140377ee128ba9600715f6459b65c1bd72

Download Submit
memory/2592-23-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2592-28-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads