ardamax | e46a0275d4e7cce726cd8047d7cf311a3b6d8afc1e703131c3265fde0d007e2e

General

Target

44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe
Size

4.2MB
MD5

44b45a6bbcc06f6da85bc88ef4e8950d
SHA1

635c654c764f68f4f23fcb7bc60fd120a849cc2e
SHA256

e46a0275d4e7cce726cd8047d7cf311a3b6d8afc1e703131c3265fde0d007e2e
SHA512

b8a63f7139bec2b0ffb8bb3f1309adc1d640cbec3bd4c0f52d6da6814fa9bf925e2df6c638c4736e2f1cd957d610091ea125bc560d9c85c050eba0887398ae34
SSDEEP

98304:WwHgthshh/JjdLjrH0KeXvtE0LjPXTaYYOVT0aCRHxWRID6A:zEhsJdLjrHje/y03PXTXYO+9H7WA

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023cae-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
808	SNFM.exe
4976	setup-4.9.0.exe
1272	setup-4.9.0.tmp

Loads dropped DLL 10 IoCs

pid	Process
4812	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe
808	SNFM.exe
808	SNFM.exe
808	SNFM.exe
4976	setup-4.9.0.exe
4976	setup-4.9.0.exe
4976	setup-4.9.0.exe
1272	setup-4.9.0.tmp
1272	setup-4.9.0.tmp
1272	setup-4.9.0.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SNFM Agent = "C:\\Windows\\SysWOW64\\28463\\SNFM.exe"	SNFM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\AKV.exe	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\28463	SNFM.exe
File created	C:\Windows\SysWOW64\28463\SNFM.001	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\SNFM.006	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\SNFM.007	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\SNFM.exe	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-4.9.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-4.9.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SNFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	808	SNFM.exe
Token: SeIncBasePriorityPrivilege	808	SNFM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
808	SNFM.exe
808	SNFM.exe
808	SNFM.exe
808	SNFM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 808	4812	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe	86
PID 4812 wrote to memory of 808	4812	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe	86
PID 4812 wrote to memory of 808	4812	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe	86
PID 4812 wrote to memory of 4976	4812	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe	87
PID 4812 wrote to memory of 4976	4812	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe	87
PID 4812 wrote to memory of 4976	4812	44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe	87
PID 4976 wrote to memory of 1272	4976	setup-4.9.0.exe	88
PID 4976 wrote to memory of 1272	4976	setup-4.9.0.exe	88
PID 4976 wrote to memory of 1272	4976	setup-4.9.0.exe	88

C:\Users\Admin\AppData\Local\Temp\44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\44b45a6bbcc06f6da85bc88ef4e8950d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\28463\SNFM.exe
  "C:\Windows\system32\28463\SNFM.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:808
- C:\Users\Admin\AppData\Local\Temp\setup-4.9.0.exe
  "C:\Users\Admin\AppData\Local\Temp\setup-4.9.0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\is-4K7AB.tmp\setup-4.9.0.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-4K7AB.tmp\setup-4.9.0.tmp" /SL5="$702C6,3618697,53248,C:\Users\Admin\AppData\Local\Temp\setup-4.9.0.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@B3A0.tmp

Filesize
4KB

MD5
908f7f4b0cf93759447afca95cd84aa6

SHA1
d1903a49b211bcb4a460904019ee7441420aa961

SHA256
3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

SHA512
958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4K7AB.tmp\setup-4.9.0.tmp

Filesize
669KB

MD5
52950ac9e2b481453082f096120e355a

SHA1
159c09db1abcee9114b4f792ffba255c78a6e6c3

SHA256
25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd

SHA512
5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup-4.9.0.exe

Filesize
3.7MB

MD5
12d2ee2361c4251196d87de9f175af65

SHA1
7be6d4b7c0183373988c9933b0d4c56e9b35931c

SHA256
6272b1db765db95c7f0eddbaf021b2e237caa852c9df63c9c220412d51970065

SHA512
133b20b3f61d49f6d4d5b69ba5ffbfd9ccdef79415811e26907eb57d54497853431c287930087d3d31beed6400fd496bda71d8ce724e441663bbed5e5bc8028c

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
393KB

MD5
b0b09699ea39c0107af1c0833f07c054

SHA1
b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1

SHA256
be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1

SHA512
55430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796

Download Submit
C:\Windows\SysWOW64\28463\SNFM.001

Filesize
500B

MD5
1597a0a21ddd1d20778e483d6b733405

SHA1
be9bc1e337355d5ec6222e751a5c7ce8a86447fb

SHA256
a81f84d115b59913c8d15ec7b5774c3bf346a9115b09d0464ea1b940aa88048d

SHA512
47621ae6fb37f70fb01f9de4fb6c29712450941662521b1d162cd7a50d7bfb6e569f157f52451be902e09811c30af7d71b34eaa1966d11b961e4418052081c0d

Download Submit
C:\Windows\SysWOW64\28463\SNFM.006

Filesize
7KB

MD5
e0fcfa7cad88d1a8a462cee6b06cf668

SHA1
a7e49078517abc929a6da261df06556c8f5a8cf0

SHA256
340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

SHA512
430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

Download Submit
C:\Windows\SysWOW64\28463\SNFM.007

Filesize
5KB

MD5
ca72cd485d116033f1b776903ce7ee0a

SHA1
85b0b73a75b0498f56200dd1a5cf0de5371e42a3

SHA256
e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

SHA512
8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

Download Submit
C:\Windows\SysWOW64\28463\SNFM.exe

Filesize
472KB

MD5
7ca78f42e7c88f01fb7fd88321b283ff

SHA1
8f6fb4e3f5b696cac4fd54490d5f8c1862d0bb6b

SHA256
2354f408b272232ea4bb74d17d22a4332b97f1003fb9bace174a9811f2b41729

SHA512
06e822f04a4657b492a485b5a542e5c8400060abf7e71020d17965fee11f1f7c0807e32b5f9426a4fb9b4d7dd05a68ae871e5fef0807e24204351ebe569eb4ca

Download Submit
memory/808-32-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/808-57-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1272-59-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-69-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-85-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-83-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-81-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-61-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-63-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-65-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-67-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-49-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-71-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-73-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-75-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-77-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1272-79-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4976-38-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4976-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4976-35-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads