ardamax | e955528268ea2c049598faf922c2acd83dc53b5579b2a6896d0c5d52067e619a | Triage

Sharing

General

Target

9f86f954eac6b3d681d0cca5006902bf_JaffaCakes118
Size

1.0MB
Sample

241126-dvbwds1qc1
MD5

9f86f954eac6b3d681d0cca5006902bf
SHA1

121baa6cd1713088a4aad05a2df1f337f8399c7b
SHA256

e955528268ea2c049598faf922c2acd83dc53b5579b2a6896d0c5d52067e619a
SHA512

d5af495dfacd252100843da128d09ca63d8eaea1c5d7950aa478c4490edd19c175cc892f9cf6fb9366280bbc1258c267679f439fe8a825389e316d4f50e93014
SSDEEP

24576:W64MVTz+VxRx9xJujv/0X8NK+UueUqF+vtX6xMb8vUVinY:W64MTaZx9Sjv/0sNnFeLQc48C2

Score

10^/10

ardamax discovery evasion execution keylogger persistence stealer

Malware Config

Targets

- Target
  
  9f86f954eac6b3d681d0cca5006902bf_JaffaCakes118
- Size
  
  1.0MB
- MD5
  
  9f86f954eac6b3d681d0cca5006902bf
- SHA1
  
  121baa6cd1713088a4aad05a2df1f337f8399c7b
- SHA256
  
  e955528268ea2c049598faf922c2acd83dc53b5579b2a6896d0c5d52067e619a
- SHA512
  
  d5af495dfacd252100843da128d09ca63d8eaea1c5d7950aa478c4490edd19c175cc892f9cf6fb9366280bbc1258c267679f439fe8a825389e316d4f50e93014
- SSDEEP
  
  24576:W64MVTz+VxRx9xJujv/0X8NK+UueUqF+vtX6xMb8vUVinY:W64MTaZx9Sjv/0sNnFeLQc48C2
Score

10^/10

ardamax discovery evasion execution keylogger persistence stealer
- Ardamax
  A keylogger first seen in 2013.
  keylogger stealer ardamax
- Ardamax family
  ardamax
- Ardamax main executable
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

ardamaxdiscoveryevasionexecutionkeyloggerpersistencestealer

behavioral2

ardamaxdiscoveryevasionexecutionkeyloggerpersistencestealer