ardamax | caf3dd61beec3cd29f1cf3a6f076963a4ab4aa9de5094b8b794f9444c09ffb11

General

Target

6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe
Size

1.0MB
MD5

6a2e9c2c6c78254f6d577cd1992659e0
SHA1

16d0a95b83b48100ce6429d33a3ca50467ba086e
SHA256

caf3dd61beec3cd29f1cf3a6f076963a4ab4aa9de5094b8b794f9444c09ffb11
SHA512

780e3f679a649ca5ead6dc3b766ffeac5d49eaa49fa77cb8fd94633a7f4d2d9dcd476ee231680ed90574fec6ed5ce7814412aa242a2bd6d2b33c905aa52958f3
SSDEEP

24576:ujXTYfnMcRHd6wVo85EwWHLi5NfDYTJZ8EvErAV8vaBq:uDTonJR9iwSJyPrAU5

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

Processes:

resource	yara_rule
C:\Windows\GLABII\DIM.exe	family_ardamax

Executes dropped EXE 1 IoCs

Processes:

DIM.exe

pid process

2316 DIM.exe
Loads dropped DLL 2 IoCs

Processes:

6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exeDIM.exe

pid process

2600 6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe
2316 DIM.exe

pid	process
2316	DIM.exe

pid	process
2600	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe
2316	DIM.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

DIM.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DIM Start = "C:\\Windows\\GLABII\\DIM.exe"	DIM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 6 IoCs

Processes:

6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exeDIM.exe

description	ioc	process
File created	C:\Windows\GLABII\DIM.exe	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe
File opened for modification	C:\Windows\GLABII	DIM.exe
File created	C:\Windows\GLABII\DIM.004	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe
File created	C:\Windows\GLABII\DIM.001	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe
File created	C:\Windows\GLABII\DIM.002	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe
File created	C:\Windows\GLABII\AKV.exe	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exeDIM.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DIM.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

DIM.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Web3.5 = "1729595255" DIM.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DIM.exe

description pid process

Token: 33 2316 DIM.exe
Token: SeIncBasePriorityPrivilege 2316 DIM.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

DIM.exe

pid process

2316 DIM.exe
2316 DIM.exe
2316 DIM.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Web3.5 = "1729595255"	DIM.exe

description	pid	process
Token: 33	2316	DIM.exe
Token: SeIncBasePriorityPrivilege	2316	DIM.exe

pid	process
2316	DIM.exe
2316	DIM.exe
2316	DIM.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe

description	pid	process	target process
PID 2600 wrote to memory of 2316	2600	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe	DIM.exe
PID 2600 wrote to memory of 2316	2600	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe	DIM.exe
PID 2600 wrote to memory of 2316	2600	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe	DIM.exe
PID 2600 wrote to memory of 2316	2600	6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe	DIM.exe

C:\Users\Admin\AppData\Local\Temp\6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6a2e9c2c6c78254f6d577cd1992659e0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\GLABII\DIM.exe
  "C:\Windows\GLABII\DIM.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\GLABII\AKV.exe

Filesize
490KB

MD5
7c945f8ff017b9c3e00fb23e47c05b88

SHA1
c5808f4a6494f5f619584ce1eea3bd63fab41675

SHA256
0beb5579a7321017b3efe319e40af7ad940c4d64916295929fe0e88bdd35e848

SHA512
feb202e2c63be69ad77160716bcf4f83bd90571349c6115955fb2ea584d8913dd153ca782974e3b50c9a8cd58df01ade6c88339f0c43c2af5778fc3457132246

Download Submit
C:\Windows\GLABII\DIM.001

Filesize
60KB

MD5
256d32d205671ac8ed51e56c5c5d2d56

SHA1
c0e98db79b026a2ba7c4838bf11d6e8775a10262

SHA256
064d8c21bd0cf41315cef61af65be92327275633fbdf37771c3d996202909a9a

SHA512
197a6c0d27550d4756c124b41310ae39e546449da3254c15d0070bfeec4600d12f4e653f12e4a554c69eeab615f3e159960805c029f9b4abb197b64af78c5581

Download Submit
C:\Windows\GLABII\DIM.002

Filesize
42KB

MD5
ecb9e8c27d6cc6ffd1e857767b9c6f24

SHA1
10a9a5054e6f1c8d1bda456b9ecb5bf359faf010

SHA256
5d948e3a55e9b1de0e9f8f89d0dd3a769bbd8d178f3297cc02864f5688dbcb29

SHA512
259ae145a962426b9b60d585d939caf86043b9031480b472ab8ee91eada3d1d7d6fc502718fbbc07ac9600368e81f87e68fd10d5fa039a85a1d4a8ddfde1968e

Download Submit
C:\Windows\GLABII\DIM.004

Filesize
766B

MD5
810290ddc372e0c79905b874e593e149

SHA1
a51282a6bfec42916d189602f34adac63537ac68

SHA256
33e8a565d49f53fa153d00c591bff289958f87c1b0530a31c6f839e374a699ef

SHA512
eeab971949650c2bf64f2186079220d7e65e922e918df3519c4ce5eb6bd5237546f1261f4e948e641528cfd26fa437dde6e61b1f77f241a6eb55cc95cc9e2da9

Download Submit
C:\Windows\GLABII\DIM.exe

Filesize
1.3MB

MD5
6c94881041df04b34498298262be0095

SHA1
a55cf3e5b3d04cbc3fff689219bb4176db698afa

SHA256
b8e1a7f773703fd5b7e7658bc3f54fd50e4ea6502f9ed3b996c3ef9c977b3d9f

SHA512
dba2ad2dcb51d7dc9e01e668e91132fbb22c6c1423c3dc96c081a1bcc2614987e4091d99c9035abf4c1c2b485c36095a06cfaea67431e1d18a83c186bcea4fbf

Download Submit
memory/2316-15-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2316-17-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads