ardamax | c5ff2f0c8356fabe5c60a06f07adf3f7b0b284ff76179d6dfa701a12e8d175f4

General

Target

8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe
Size

1.2MB
MD5

8a41ccbad339034e3373451dcaef8e17
SHA1

9ef973f43bd96c7e35d2b3b37b3730f306a7e829
SHA256

c5ff2f0c8356fabe5c60a06f07adf3f7b0b284ff76179d6dfa701a12e8d175f4
SHA512

69bcb18ae99306667a6d837040ce8e94de83f028bc3dbd1584ee4f68c92c676824649412e53a8c6fa5e43f4a01801fec1d599f555ec268bd60d33747f1c1955e
SSDEEP

24576:V1ITQpvdvblQlzHFzgH6p7oZMDyviJxE9cgm8Ll2/HkGjx:VSTQlFlQFFMA7gMD0iJi9BmKIZ

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\CLYIVF\VBB.exe	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

VBB.exe

pid process

3092 VBB.exe
Loads dropped DLL 1 IoCs

Processes:

VBB.exe

pid process

3092 VBB.exe

pid	process
3092	VBB.exe

pid	process
3092	VBB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

VBB.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VBB Start = "C:\\Windows\\SysWOW64\\CLYIVF\\VBB.exe"	VBB.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

Processes:

VBB.exe8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\CLYIVF\	VBB.exe
File created	C:\Windows\SysWOW64\CLYIVF\VBB.004	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\CLYIVF\VBB.001	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\CLYIVF\VBB.002	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\CLYIVF\AKV.exe	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\CLYIVF\VBB.exe	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exeVBB.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VBB.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

VBB.exe

pid process

3092 VBB.exe
3092 VBB.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

VBB.exe

description pid process

Token: 33 3092 VBB.exe
Token: SeIncBasePriorityPrivilege 3092 VBB.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

VBB.exe

pid process

3092 VBB.exe
3092 VBB.exe
3092 VBB.exe
3092 VBB.exe

pid	process
3092	VBB.exe
3092	VBB.exe

description	pid	process
Token: 33	3092	VBB.exe
Token: SeIncBasePriorityPrivilege	3092	VBB.exe

pid	process
3092	VBB.exe
3092	VBB.exe
3092	VBB.exe
3092	VBB.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe

description	pid	process	target process
PID 4852 wrote to memory of 3092	4852	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe	VBB.exe
PID 4852 wrote to memory of 3092	4852	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe	VBB.exe
PID 4852 wrote to memory of 3092	4852	8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe	VBB.exe

C:\Users\Admin\AppData\Local\Temp\8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a41ccbad339034e3373451dcaef8e17_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\CLYIVF\VBB.exe
  "C:\Windows\system32\CLYIVF\VBB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\CLYIVF\AKV.exe

Filesize
487KB

MD5
ad6bc708ce46e6ffa081d61d4f36c6a7

SHA1
d01f95e867eb9333e240f107a11740a33abeb882

SHA256
71d5313468cf3e39fe3ddface2f7f81dbf39c0997cfc85b1b9cf3aba1ea12176

SHA512
f31be421771a00d1107be595ee22e29abcf8e6c13418c1160c061e541ff93f3b7c741fd2bd14de2501a20aceceb0e4c6f68dd3ebb7cd26c2c93afe25690af672

Download Submit
C:\Windows\SysWOW64\CLYIVF\VBB.001

Filesize
61KB

MD5
d373bbf76430957bcd2e57b0c9282478

SHA1
060e94a44aae965fc871ef99ef72e2903c18a812

SHA256
6b417853ea93c6b973d0fb5d12cce6136dcf57b97c8566087c6d8b2b22b499e6

SHA512
dc6a7d2e28d169b1c3ed5d8004bb25e4f6ba0cf71f69b8d74204d531f17d3f16b838df0bc699a9c4f4addf979676fffe0fc92f16035f7a5ee774593f9f24249a

Download Submit
C:\Windows\SysWOW64\CLYIVF\VBB.002

Filesize
44KB

MD5
78d9c23d5e387c983ec0f9d1cd5e7a3c

SHA1
3568035056154177c2f182c0fcb52b5aad99b817

SHA256
14099ac39320e34d4924d349da7ee737a764587f24e913a13fbe08d1f9afb82a

SHA512
5c0d169434ad2800cc82ef4b6ec3b25c765fdd4314988754c1eec57405cfbdde2c47632a333aacfb80563f427bdd2f567ac291865052f14d9d99f8ca042acdeb

Download Submit
C:\Windows\SysWOW64\CLYIVF\VBB.004

Filesize
1KB

MD5
bc73fff222e2ec987020e3eb8681ae27

SHA1
5cf9eee7d2ed3bb5ac0e5571ea7aae6ea09c95c0

SHA256
f292129556412e3257a311427363f50cce43141d9be92828d9b6fc7a077fa08f

SHA512
8633ca66ef4963d53e2208ef8bbc89788d039110928a3ac3a7a09eeb69dfc9c9c27f84b35a9cdfa1f48d6a8cd03613ecd6dec07745012c5383880cf28fae6902

Download Submit
C:\Windows\SysWOW64\CLYIVF\VBB.exe

Filesize
1.7MB

MD5
0c3ef1e16d7066db155af6503190886c

SHA1
d606edb9f5c1a6b421eac400e545dbcb78c19353

SHA256
8f571c7d18ad3f2facf0662ee183a0ccd42fd1bcdb2cb544ab8bae8411acaa01

SHA512
6275471d26b86f2212123aafceccf4a636b29d8e0b635f0a265d0fb99ff04cc282e03d174c37f6eb8ec5c8fc82fb73ca6a97192e6049a9d36f6070969d234da3

Download Submit
memory/3092-16-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/3092-18-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads