ardamax | b97a4ee3b727ff75cbe7441ccab81c1852ebb26874c9758fb05fdd2f1e23cd11

General

Target

b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe
Size

500KB
MD5

b69b0b544f3ffa069ea72bda41526f75
SHA1

615bce94e4e5a81a6a8ed5bdcb5d41cff4a1337f
SHA256

b97a4ee3b727ff75cbe7441ccab81c1852ebb26874c9758fb05fdd2f1e23cd11
SHA512

96583a953d54c4255d7107d17d04c2702f91128338ef0f16eed5bbaa678ccb089e2b5e44755e99146bdfbe039f14fe57356c5091a61ed0caa536a399f54fc0a9
SSDEEP

12288:6CYu4W3dJ31NCSiDQhaVsfFl4JBlZo39re5EjY:4O/1ticpfF2vlaty5aY

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0006000000019279-18.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
3032	XAFX.exe

Loads dropped DLL 3 IoCs

pid	Process
1900	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe
1900	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe
1900	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XAFX Agent = "C:\\Windows\\SysWOW64\\28463\\XAFX.exe"	XAFX.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\XAFX.001	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\XAFX.006	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\XAFX.007	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\XAFX.exe	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XAFX.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3032	1900	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe	31
PID 1900 wrote to memory of 3032	1900	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe	31
PID 1900 wrote to memory of 3032	1900	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe	31
PID 1900 wrote to memory of 3032	1900	b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b69b0b544f3ffa069ea72bda41526f75_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\28463\XAFX.exe
  "C:\Windows\system32\28463\XAFX.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\AKV.exe

Filesize
411KB

MD5
38defc8742dcd7b684e5ae1193e7e668

SHA1
5710271eb398f63f0f0b209c46460ff9665df9bb

SHA256
b74a277270efc272bef1e264dc11289b7f13c651ac7640745df46bf6792c36d1

SHA512
46cc4b677af570905ac0c36b4e85030a618cefd6e4eb4eb4fc850ad2df45c14233024f0aa655e28649212aa42bf74499a91a682750748f75132aa18d1464cb84

Download Submit
C:\Windows\SysWOW64\28463\XAFX.001

Filesize
484B

MD5
51d415b990c2527b56d9a879ec5b4d5a

SHA1
e72b07a9eb5930051e8cec4510b27ed8ebf84448

SHA256
7c83278a43c62e8316e616b67eb045f6fd92ed262f9427d41ea8c484622c368b

SHA512
a6d532904410a35631954609fcda97950a589583f76c85721dc989a5cd5c1217f0148ce891061c3bacbb20a95c977df3782d8c79cd54dfb6590a38c3a73978d4

Download Submit
C:\Windows\SysWOW64\28463\XAFX.006

Filesize
8KB

MD5
e44628a2b8e2044ebb635eed3d5f79d9

SHA1
87120d6466ae60ea0df734c578f371c5c77acf3a

SHA256
6742a87a0df8e620ff5314729c94cfaa738daf172220868cb748b09bb4e72ca4

SHA512
ab1ec2ced331a14d60976338715cb9a09144b784d5c3fbcee139e85f843cab9aaa6627ae7a2f7f9d82cda5297fcc045e97385639397acb252bb18ebf315db37e

Download Submit
C:\Windows\SysWOW64\28463\XAFX.007

Filesize
5KB

MD5
75d6279af7fa9545ba7b7b01a85d2e12

SHA1
2fa39502b0aaa872712068747ff4f0800e955898

SHA256
189a54410440caab60ed99dadf5fed2edcb0d36e5ed3e9a59be41026662bbc0e

SHA512
26c21d6e68fef49d988d4e20da9df164760318087752d4d872275efdc0c667fc31426a916acb8eeb65a0acf20ce3bd3c8953bd34cd83cc46cf44c329469f2ae9

Download Submit
C:\Windows\SysWOW64\28463\XAFX.exe

Filesize
526KB

MD5
c4e65cee2c8eaf4a4c03852192f49156

SHA1
7c7b416d08056e2ecf215a6ce7126cf74ca3d87e

SHA256
95b5415e32ec93a15a060b6e461151632764cc7693e9d3525e495aa3c9ae1fb0

SHA512
59303381117ced1d99f67fbb10921e34f7ba066edb937ae6e27262941772a48fbe40b861a2954a1e40160b0661f1e2140377ee128ba9600715f6459b65c1bd72

Download Submit
\Users\Admin\AppData\Local\Temp\@C4D5.tmp

Filesize
4KB

MD5
102f90f4f42551b2acd64923065a2b56

SHA1
18bbbd1a10b603e05816f5a2baf9a6bed74346a3

SHA256
623f4b9a4910c8815d2ab19696668258ff2c30c3adac8967d616f7e60ec619fd

SHA512
2c8338799bcd64083dbe8b0e763424962dd024c52996bae590500b7d844595b539549b6c239f68f3866d5fda9db10808e8e9b489031a1e942bc34277f9a1d9d3

Download Submit
memory/3032-24-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads