ardamax | 889ade68a12b10b0da4c475ee17d713c42c87f351c7febd33a60e231ee0c6cca | Triage

Sharing

General

Target

88e2aebed2178f287e97897dfc06330d_JaffaCakes118
Size

856KB
Sample

241103-bkes7a1ajb
MD5

88e2aebed2178f287e97897dfc06330d
SHA1

d92969b38bf59a6dedd35fc39e3a6a9ed98e4a6a
SHA256

889ade68a12b10b0da4c475ee17d713c42c87f351c7febd33a60e231ee0c6cca
SHA512

d0517d5ffd83d5b7db8112f5ead4504a9b4d8f3f033555b9e7e7bc49e86301a65f1b604de5169ea5d383dd5c01394a984668c1906e221aae6368e1cb73762fc3
SSDEEP

12288:cSZniw9DMa8I/Z7EJPaS7/5yEf0W7Y3NEld7id4KCMe5nPuD1OEB9Fxx1WNCfe3g:cSN1DLBgxfY3eleCrPuDhfNGQ

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Targets

- Target
  
  sucrose working/srose new.exe
- Size
  
  1.9MB
- MD5
  
  5742ea4de78005e529e1fbdfa83a2356
- SHA1
  
  880ff6373d8ab9d60657487d354f25d631c11121
- SHA256
  
  035afa353417b64a928baa6de04eb1c39e5d7a88d3f2802df4c40e5b9b6f9da7
- SHA512
  
  45133a6f8271fa4d1f9a280d436c43fed4ebd3ad7cdf5e13c9de7ae9c7970c77e2aebee8548cc4bbac0d053cce300d3d212df184739fd17cac3671bb580b90b5
- SSDEEP
  
  24576:6ZlEY11pwr39JeAzrjaoYfpBDVwVu4P8JxaNaYDXR5pzvczdzgGCd:QlEOpwL3eNoIeu4P8naNaipgzdzpCd
Score

10^/10

ardamax discovery keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ardamaxdiscoverykeyloggerpersistencestealer

behavioral2

ardamaxdiscoverykeyloggerpersistencestealer