ardamax | a1de47b16a2c5dfa09db010ea6170b2df248697caa6221298c8a7585e9778d0d

General

Target

510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe
Size

523KB
MD5

510afeb402bc03efe79596d529260b0f
SHA1

ae9672a0cfc1f0ac3c4dbf699db25970cba7cf22
SHA256

a1de47b16a2c5dfa09db010ea6170b2df248697caa6221298c8a7585e9778d0d
SHA512

7e7b75f88955ed4deec31d5922d2cfcab3151439970b8b4c0884cfa5ec48187ae7025d251d5e179818e573b4a167a491b1c23843004a67b7d49a7ae0f803a69e
SSDEEP

12288:IjRUTV5nXGNwBKSiI6zdylJcoDUYIKoxzeIfxy9oK6yBYFx2q:ZTV5nVBRWzAFDZEzeIfxy9oK6H3

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000001939b-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2696	KIMU.exe

Loads dropped DLL 3 IoCs

pid	Process
1884	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe
1884	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe
1884	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KIMU Agent = "C:\\Windows\\SysWOW64\\28463\\KIMU.exe"	KIMU.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\KIMU.001	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\KIMU.006	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\KIMU.007	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\KIMU.exe	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KIMU.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2696	1884	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe	30
PID 1884 wrote to memory of 2696	1884	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe	30
PID 1884 wrote to memory of 2696	1884	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe	30
PID 1884 wrote to memory of 2696	1884	510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\510afeb402bc03efe79596d529260b0f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\28463\KIMU.exe
  "C:\Windows\system32\28463\KIMU.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\AKV.exe

Filesize
411KB

MD5
38defc8742dcd7b684e5ae1193e7e668

SHA1
5710271eb398f63f0f0b209c46460ff9665df9bb

SHA256
b74a277270efc272bef1e264dc11289b7f13c651ac7640745df46bf6792c36d1

SHA512
46cc4b677af570905ac0c36b4e85030a618cefd6e4eb4eb4fc850ad2df45c14233024f0aa655e28649212aa42bf74499a91a682750748f75132aa18d1464cb84

Download Submit
C:\Windows\SysWOW64\28463\KIMU.001

Filesize
390B

MD5
efe313b887df1f70e3e2731f1142cd5a

SHA1
fdd6d44b3ad46b5b6e1e9e045f445e4f235a4e0f

SHA256
f891c6ba4a66f7d4035e643b3fd6dad7bc14a44b1818ea198330d9dd42fb5e22

SHA512
c2babee8d8f5380309c9022dacbb7371041f9e84c0d03134b0e84500e9abf0a4317a8ea24627ee95a043a6c885ca6f5fd48034a735a2648c91ae5c2c919d63c6

Download Submit
C:\Windows\SysWOW64\28463\KIMU.006

Filesize
8KB

MD5
e44628a2b8e2044ebb635eed3d5f79d9

SHA1
87120d6466ae60ea0df734c578f371c5c77acf3a

SHA256
6742a87a0df8e620ff5314729c94cfaa738daf172220868cb748b09bb4e72ca4

SHA512
ab1ec2ced331a14d60976338715cb9a09144b784d5c3fbcee139e85f843cab9aaa6627ae7a2f7f9d82cda5297fcc045e97385639397acb252bb18ebf315db37e

Download Submit
C:\Windows\SysWOW64\28463\KIMU.007

Filesize
5KB

MD5
75d6279af7fa9545ba7b7b01a85d2e12

SHA1
2fa39502b0aaa872712068747ff4f0800e955898

SHA256
189a54410440caab60ed99dadf5fed2edcb0d36e5ed3e9a59be41026662bbc0e

SHA512
26c21d6e68fef49d988d4e20da9df164760318087752d4d872275efdc0c667fc31426a916acb8eeb65a0acf20ce3bd3c8953bd34cd83cc46cf44c329469f2ae9

Download Submit
\Users\Admin\AppData\Local\Temp\@2BF0.tmp

Filesize
4KB

MD5
102f90f4f42551b2acd64923065a2b56

SHA1
18bbbd1a10b603e05816f5a2baf9a6bed74346a3

SHA256
623f4b9a4910c8815d2ab19696668258ff2c30c3adac8967d616f7e60ec619fd

SHA512
2c8338799bcd64083dbe8b0e763424962dd024c52996bae590500b7d844595b539549b6c239f68f3866d5fda9db10808e8e9b489031a1e942bc34277f9a1d9d3

Download Submit
\Windows\SysWOW64\28463\KIMU.exe

Filesize
526KB

MD5
c4e65cee2c8eaf4a4c03852192f49156

SHA1
7c7b416d08056e2ecf215a6ce7126cf74ca3d87e

SHA256
95b5415e32ec93a15a060b6e461151632764cc7693e9d3525e495aa3c9ae1fb0

SHA512
59303381117ced1d99f67fbb10921e34f7ba066edb937ae6e27262941772a48fbe40b861a2954a1e40160b0661f1e2140377ee128ba9600715f6459b65c1bd72

Download Submit
memory/2696-24-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads