ardamax | 1e533bab76bdb8840a680fcd6832a58f23c51f7deffbb4bcaded77c5936a5eee

General

Target

7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
Size

563KB
MD5

7574324cc1420c1bc37f45126fb2faf1
SHA1

4b35f4a637237032fe4259702a5e78dca5b22484
SHA256

1e533bab76bdb8840a680fcd6832a58f23c51f7deffbb4bcaded77c5936a5eee
SHA512

ef590f9bc2f2a7fb4803da85df716478d04e23091aaf2a4a2f3f1ccb890cfad1a2f98886e49a94e45a51978e80e4ae341d67dea88f09b7f1e9df916b8e7b6c9c
SSDEEP

12288:qjUsNOJqN9qFoHyglauEVq75tO0zEEIg5b9hufIgxvIu49i437pT/:oZN/qoHyglZ2q9EEIg5RhwSu1ch/

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016dc6-11.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2560	system32YEOT.exe
2712	By-BrainstorM Koxp Buglar 1823.exe

Loads dropped DLL 3 IoCs

pid	Process
2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system32YEOT Agent = "C:\\Windows\\system32YEOT.exe"	system32YEOT.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system32YEOT.006	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
File created	C:\Windows\system32YEOT.007	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
File created	C:\Windows\system32YEOT.exe	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
File created	C:\Windows\system32AKV.exe	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
File created	C:\Windows\system32YEOT.009	system32YEOT.exe
File opened for modification	C:\Windows\system32YEOT.009	system32YEOT.exe
File created	C:\Windows\system32YEOT.009.tmp	system32YEOT.exe
File created	C:\Windows\Oct_25_2024__00_35_32.jpg	system32YEOT.exe
File created	C:\Windows\system32YEOT.001	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
File created	C:\Windows\Oct_25_2024__00_36_32.jpg	system32YEOT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32YEOT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	By-BrainstorM Koxp Buglar 1823.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2560	system32YEOT.exe
Token: SeIncBasePriorityPrivilege	2560	system32YEOT.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2560	system32YEOT.exe
2560	system32YEOT.exe
2560	system32YEOT.exe
2560	system32YEOT.exe
2560	system32YEOT.exe
2712	By-BrainstorM Koxp Buglar 1823.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2560	2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe	30
PID 2016 wrote to memory of 2560	2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe	30
PID 2016 wrote to memory of 2560	2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe	30
PID 2016 wrote to memory of 2560	2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe	30
PID 2016 wrote to memory of 2712	2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe	31
PID 2016 wrote to memory of 2712	2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe	31
PID 2016 wrote to memory of 2712	2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe	31
PID 2016 wrote to memory of 2712	2016	7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7574324cc1420c1bc37f45126fb2faf1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\system32YEOT.exe
  "C:\Windows\system32YEOT.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2560
- C:\Users\Admin\AppData\Local\Temp\By-BrainstorM Koxp Buglar 1823.exe
  "C:\Users\Admin\AppData\Local\Temp\By-BrainstorM Koxp Buglar 1823.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32YEOT.001

Filesize
444B

MD5
8948fce344a520a4552aa3bfac1685a1

SHA1
fa9711834a465a630227092ba910d593907fb179

SHA256
b79503b6caa0f4198205d99d0586ff4e833b084ebabaf5480b85724eb685c3ac

SHA512
d5e43e02c0016ac6dbd5a7c31336b71a2529fdcf121d28a0235302dc62e31e36c2dbd037ec35ea0e334b7d219e23fc4a74bd5c0d237d8a9b6cf26061029e1d90

Download Submit
C:\Windows\system32YEOT.006

Filesize
7KB

MD5
32dd7b4bc8b6f290b0ece3cc1c011c96

SHA1
b979683868b399c6a6204ebaed9fc9c784a0429a

SHA256
6dcce9bbba5c2de47eea3abf7597a9c4fb2e4d358efc3752fa65c169cccfa2a1

SHA512
9e0d720799fe816f7d09c8a722b762203b6f12a8625c1c93cd640219ecc35969bd641b4d9e6dc04ab6f95ceb73235a438eb7d48ee9402118db3618b5760551ea

Download Submit
C:\Windows\system32YEOT.007

Filesize
5KB

MD5
e8155b68775ed29590e14df80fdc0e9f

SHA1
ed449da02e648a524004c265f3c37496d2f07f1f

SHA256
b39ba894b0a9a3201461ddd9ee9b297928e793dff221a47f019e75c11df631f3

SHA512
b14e00c46cf9bed0aca0f85775f624ff064f2d2afe1fa68b61bee5729db73cf9a8eced669c52d7cbb9504ff1b369a9a16a0f36c71a70c13c0bd1eaf5e07ccc11

Download Submit
C:\Windows\system32YEOT.009

Filesize
597KB

MD5
151b1d06f68bd0860d25fbcacc79bbd0

SHA1
67a507638a2eb22b8c734186fd195810efe648a5

SHA256
02e766ac01dfce21dead4bc624e09a9b9dac217595382819e265bd2af6b9fa91

SHA512
70259dbb102649e0dea2995f90f37ec45627bee2b4233f0d0f17c7ff2f4d51f843b5f6a587c915509d832ae57b1de01bffac733db8588fb9a9a2b844a437cf79

Download Submit
C:\Windows\system32YEOT.exe

Filesize
471KB

MD5
3c06bbc025b61d2182ef5573f2852bda

SHA1
ebc1464c00b13fb5b3f80a59c80b595020e1fe7c

SHA256
e7f64e7215284cdeb8ef1eba28733f7aeae7f6977f82809d8de1e76a2e249085

SHA512
9d839ada211b85fc1efb1fe7bb3ce66fcf0e8069221d958234649c2ac5dc0f1bd06f1a016f9c727077af36fb46cac5409be9c8a8201d17f689c6b473aa01acdc

Download Submit
\Users\Admin\AppData\Local\Temp\@C1AA.tmp

Filesize
4KB

MD5
d9e02f226fc338d14df200ba9a700625

SHA1
414f134a16a309b31e418ed9e08c0c48aaf6e2bc

SHA256
8165757efb79acceb9fd0bfae6b2c19b8f087cc0461abb17941d460dbdf2e260

SHA512
13c73381602fe2593312d41ab4bc5cd5f922ac651f9e71e3fe3c58e7f0c5c73ecc9d79d61ec46f33a0a81cf73373421eeb510bd99650c0f53af30974ed61b8ca

Download Submit
\Users\Admin\AppData\Local\Temp\By-BrainstorM Koxp Buglar 1823.exe

Filesize
288KB

MD5
e6c19bae2265d7730362c9ed4e7269a7

SHA1
6dc352a5f22a709a847c2d1bfbefa84e1c51cdf6

SHA256
afc9ef1b43e0668e0c28542bf4c1f415350d6f4ccf7db4d7b3c35ee27fb5cd4e

SHA512
af7c1c6de82c65c29054b8777abd6e4519da6c633397351f07c2ad5cd55f4a1e9c0b6ac6dbb6c7046f2637216a18aafcd63e22b87793be7548eb04cc30671cbf

Download Submit
memory/2016-28-0x0000000077D2F000-0x0000000077D30000-memory.dmp

Filesize
4KB

Download
memory/2016-31-0x0000000077D2F000-0x0000000077D30000-memory.dmp

Filesize
4KB

Download
memory/2016-33-0x0000000002140000-0x0000000002146000-memory.dmp

Filesize
24KB

Download
memory/2016-32-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/2560-38-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2560-41-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2560-42-0x0000000001DA0000-0x0000000001DA6000-memory.dmp

Filesize
24KB

Download
memory/2560-17-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2712-34-0x0000000077D2F000-0x0000000077D30000-memory.dmp

Filesize
4KB

Download
memory/2712-35-0x0000000077D2F000-0x0000000077D30000-memory.dmp

Filesize
4KB

Download
memory/2712-39-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2712-40-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads