ardamax | a40516d2794c5e86d2840903089d202b584b8199ecfaf8f9a8cd37582038ef1e

General

Target

8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe
Size

501KB
MD5

8f4fc18b5ce85b6ca3264f1d49d25188
SHA1

c0bb74fc54d25571bb3ce8aa78c0619e52c7e8ff
SHA256

a40516d2794c5e86d2840903089d202b584b8199ecfaf8f9a8cd37582038ef1e
SHA512

b3bc2d9e95328d7405f5f13885d230025c1b5031beab42ccb7bc05aacc31d7183eb50679b45a4c385db4b5172a8d09c353f554f07b1df4a18349520c460a5ee9
SSDEEP

12288:F4h0VSkuBJ/T+MGme5Xz/q2R23s4X0a/p57g:usubT+Mle53H4nG

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\28463\VTRX.exe	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

VTRX.exe

pid process

1892 VTRX.exe
Loads dropped DLL 4 IoCs

Processes:

8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exeVTRX.exe

pid process

1896 8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe
1892 VTRX.exe
1892 VTRX.exe
1892 VTRX.exe

pid	process
1892	VTRX.exe

pid	process
1896	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe
1892	VTRX.exe
1892	VTRX.exe
1892	VTRX.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

VTRX.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VTRX Agent = "C:\\Windows\\SysWOW64\\28463\\VTRX.exe"	VTRX.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

Processes:

8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exeVTRX.exe

description	ioc	process
File created	C:\Windows\SysWOW64\28463\VTRX.007	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\VTRX.exe	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\28463	VTRX.exe
File created	C:\Windows\SysWOW64\28463\VTRX.001	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\VTRX.006	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exeVTRX.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VTRX.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

VTRX.exe

description pid process

Token: 33 1892 VTRX.exe
Token: SeIncBasePriorityPrivilege 1892 VTRX.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

VTRX.exe

pid process

1892 VTRX.exe
1892 VTRX.exe
1892 VTRX.exe
1892 VTRX.exe
1892 VTRX.exe

description	pid	process
Token: 33	1892	VTRX.exe
Token: SeIncBasePriorityPrivilege	1892	VTRX.exe

pid	process
1892	VTRX.exe
1892	VTRX.exe
1892	VTRX.exe
1892	VTRX.exe
1892	VTRX.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe

description	pid	process	target process
PID 1896 wrote to memory of 1892	1896	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe	VTRX.exe
PID 1896 wrote to memory of 1892	1896	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe	VTRX.exe
PID 1896 wrote to memory of 1892	1896	8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe	VTRX.exe

C:\Users\Admin\AppData\Local\Temp\8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f4fc18b5ce85b6ca3264f1d49d25188_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\28463\VTRX.exe
  "C:\Windows\system32\28463\VTRX.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@9EEF.tmp

Filesize
4KB

MD5
102f90f4f42551b2acd64923065a2b56

SHA1
18bbbd1a10b603e05816f5a2baf9a6bed74346a3

SHA256
623f4b9a4910c8815d2ab19696668258ff2c30c3adac8967d616f7e60ec619fd

SHA512
2c8338799bcd64083dbe8b0e763424962dd024c52996bae590500b7d844595b539549b6c239f68f3866d5fda9db10808e8e9b489031a1e942bc34277f9a1d9d3

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
411KB

MD5
38defc8742dcd7b684e5ae1193e7e668

SHA1
5710271eb398f63f0f0b209c46460ff9665df9bb

SHA256
b74a277270efc272bef1e264dc11289b7f13c651ac7640745df46bf6792c36d1

SHA512
46cc4b677af570905ac0c36b4e85030a618cefd6e4eb4eb4fc850ad2df45c14233024f0aa655e28649212aa42bf74499a91a682750748f75132aa18d1464cb84

Download Submit
C:\Windows\SysWOW64\28463\VTRX.001

Filesize
470B

MD5
2c14c76ea29100ccc712f5a28d1b70ee

SHA1
2716ed2497b8246ae7dd5b7c4bff6c18c7d7b744

SHA256
86c5d016fd4c74d422bc2fc3e978d988a41c1e848e7d7bf189a63a0b055f7ac1

SHA512
01fa00658ca7ef43327d44b8f87ef75acde801e99d00c3d3861d92ea12a1240ba65c17bf903baa3f6d5d81d6eeca1bdf0564ae5b989bed4acf475534a46e12db

Download Submit
C:\Windows\SysWOW64\28463\VTRX.006

Filesize
8KB

MD5
e44628a2b8e2044ebb635eed3d5f79d9

SHA1
87120d6466ae60ea0df734c578f371c5c77acf3a

SHA256
6742a87a0df8e620ff5314729c94cfaa738daf172220868cb748b09bb4e72ca4

SHA512
ab1ec2ced331a14d60976338715cb9a09144b784d5c3fbcee139e85f843cab9aaa6627ae7a2f7f9d82cda5297fcc045e97385639397acb252bb18ebf315db37e

Download Submit
C:\Windows\SysWOW64\28463\VTRX.007

Filesize
5KB

MD5
75d6279af7fa9545ba7b7b01a85d2e12

SHA1
2fa39502b0aaa872712068747ff4f0800e955898

SHA256
189a54410440caab60ed99dadf5fed2edcb0d36e5ed3e9a59be41026662bbc0e

SHA512
26c21d6e68fef49d988d4e20da9df164760318087752d4d872275efdc0c667fc31426a916acb8eeb65a0acf20ce3bd3c8953bd34cd83cc46cf44c329469f2ae9

Download Submit
C:\Windows\SysWOW64\28463\VTRX.exe

Filesize
526KB

MD5
c4e65cee2c8eaf4a4c03852192f49156

SHA1
7c7b416d08056e2ecf215a6ce7126cf74ca3d87e

SHA256
95b5415e32ec93a15a060b6e461151632764cc7693e9d3525e495aa3c9ae1fb0

SHA512
59303381117ced1d99f67fbb10921e34f7ba066edb937ae6e27262941772a48fbe40b861a2954a1e40160b0661f1e2140377ee128ba9600715f6459b65c1bd72

Download Submit
memory/1892-23-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/1892-27-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads