ardamax | f4ae61281e5b4bb3b29b1c5e69da2201e7fbfe35bc30a1ca638ad65c10f4b872

General

Target

d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe
Size

497KB
MD5

d2823e1de98fdb37a3b71a5c14bcd567
SHA1

2dd0e7d1e478c5d34633161784def2bb2a79ab19
SHA256

f4ae61281e5b4bb3b29b1c5e69da2201e7fbfe35bc30a1ca638ad65c10f4b872
SHA512

853b7ee086f91677ee1470fc97206171bdb27ea810305835fabf3b8163673118763a448e02184e783fac7dcc2b475a4a2b81aed3ca86bbf2861c662ed8c1c2f1
SSDEEP

12288:fTkUCrIaTbOItA0i4KXFXQYzB9FrzdU48O385WQ:IUCrIa3OUn/eQmz5dUV5

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016de8-11.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2360	system32TJAI.exe
2452	GRAPP.exe

Loads dropped DLL 3 IoCs

pid	Process
3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe
3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe
3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system32TJAI Agent = "C:\\Windows\\system32TJAI.exe"	system32TJAI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32TJAI.exe	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe
File created	C:\Windows\system32AKV.exe	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe
File created	C:\Windows\system32TJAI.001	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe
File created	C:\Windows\system32TJAI.006	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe
File created	C:\Windows\system32TJAI.007	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32TJAI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GRAPP.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2360	system32TJAI.exe
Token: SeIncBasePriorityPrivilege	2360	system32TJAI.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2360	system32TJAI.exe
2360	system32TJAI.exe
2360	system32TJAI.exe
2360	system32TJAI.exe
2360	system32TJAI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2360	3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2360	3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2360	3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2360	3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2452	3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe	31
PID 3000 wrote to memory of 2452	3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe	31
PID 3000 wrote to memory of 2452	3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe	31
PID 3000 wrote to memory of 2452	3000	d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2823e1de98fdb37a3b71a5c14bcd567_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\system32TJAI.exe
  "C:\Windows\system32TJAI.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\GRAPP.exe
  "C:\Users\Admin\AppData\Local\Temp\GRAPP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32TJAI.001

Filesize
408B

MD5
674833d379d15e2a526377f04767ac78

SHA1
2ea13df2221ae8edc31382f6f7e15afd836f6e32

SHA256
a83f21dde94a28d33fcb9347c41d38ee41561d941dca0bd91d20aca4c3504853

SHA512
619a0e1ec4b534f71bf8461850609c4b3a6c328cdfc6b9839fde1863badf2dbfbb66dae5bc1e1aac4f0868391364b214cab6ce1fa89d4c247a4c36545bcde18f

Download Submit
C:\Windows\system32TJAI.006

Filesize
7KB

MD5
ed3c7e9a789e0c5c8c49e46d4bf6a3df

SHA1
e74e617680edd83ea0172960c4389ba3f7ed431d

SHA256
f2b983e3e8cdcad665bdd0024725bb03a1a4919dcf115d031d1d4e4fe3225856

SHA512
1c70224ccf2d95563d54c8eb52e0e3fc09dee8528a8a0041517f1f85f36eec5f08ed5b8e9064827290a7b66f48849575ecb2cce3e81b4250e12806ffb7aff06d

Download Submit
C:\Windows\system32TJAI.007

Filesize
5KB

MD5
d7b3b4076038485800c17684ac22550f

SHA1
d6ce8bc1a16d46cf6bdae41308f4eafd8d24ae4f

SHA256
7f67f9360d43cc337ad5f878372e1eec94a83e7cf6b5cf56c43a8c7e2e8d869a

SHA512
209eae97c7854f26fb32132be5722a5fb7b0c275774599b456b3f8a99c5b70d90a676ecf17ab7867c47a0f653c3f7d80d02d902ddb116acb7ba366ab0662750b

Download Submit
C:\Windows\system32TJAI.exe

Filesize
471KB

MD5
186403d9ea3c30fb5c9cc7ec135c7866

SHA1
0b2ee531ae2f5c0658ffa720c1c71e986433a4fc

SHA256
99b102ae1b219cc471c47aa54da4ab4c3f4d0ee7a07ef85c7f0bca8cc6eb9bf1

SHA512
af30f64237e9998c4c2c41213a67c0bbf8687318c8e957f8a87aff43e383dd301ca674e0158cde5ab209bcf03263625fefcd0b6602c14f3d40231da7d9809dcd

Download Submit
\Users\Admin\AppData\Local\Temp\@B951.tmp

Filesize
4KB

MD5
51bee0ab97691836dc058cc6edb0a3bc

SHA1
e7a79d9eeaa9b3eb4650389d590e72f3305767d4

SHA256
fcb57ac50b7ced25bba2f806824dbbbcdf26208a1ceb2244c6f52a572b1f5f06

SHA512
92e15cf965bf2e4c258e6bf53543647b470fba9376c0fb3e9cc8d003f3be74f87f7d7935cf67b66205f1cc103df613856e2aef129a4b373336b1f0f1b5645fcc

Download Submit
\Users\Admin\AppData\Local\Temp\GRAPP.exe

Filesize
64KB

MD5
445cf2888649f9d0d425d396b09113a4

SHA1
bfde9b6b0f86c3bc664a13d3d0be5678a17d5efa

SHA256
73f5aa9e2a6c514c26efcae36afedf02780208bde4ed6bdc2e713c985beeccd7

SHA512
f8bbbac5b14ca72b8d5ea8b5db9afaf4d192c7c466563c6f5c07b0b85d236ecc692cf9f8f0be6f1f6110d131e10d577a096ce0905e0fac0d036829fd0c3d1501

Download Submit
memory/2360-35-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2360-34-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2360-17-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2360-36-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2452-32-0x000000007770F000-0x0000000077710000-memory.dmp

Filesize
4KB

Download
memory/2452-33-0x000000007770F000-0x0000000077710000-memory.dmp

Filesize
4KB

Download
memory/2452-38-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/2452-37-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/3000-30-0x0000000002A10000-0x0000000002A16000-memory.dmp

Filesize
24KB

Download
memory/3000-29-0x0000000002A00000-0x0000000002A06000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads