ardamax | f857bc2e2fd39914c427a09f2bf07ac63161658bf9bf79ac8c39be0d9e6c6893

General

Target

JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe
Size

144KB
MD5

a8c67e17555024b5078654d5d0934870
SHA1

9d0b9d27d4d769de39f8b7d33ec673c47acf6e1f
SHA256

f857bc2e2fd39914c427a09f2bf07ac63161658bf9bf79ac8c39be0d9e6c6893
SHA512

a18bf95b1e3fe5e221fae2167d53c1d6fffacece77ff3ed87e2532ccadd5484883d3f86a40b4d65c8d1f8346f01912deb0f92e647289e47d0acba76033cd7633
SSDEEP

3072:2OHHIzZHvV/N7Ygmz7AvzvWaw6Jin6BrwcejqSGWVtS+H4sg4VwwXv:pU9/NUnAvzvWawRurgqSza3CnXv

Score

10^/10

ardamax discovery keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000190c9-9.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
1940	AKL.exe

Loads dropped DLL 5 IoCs

pid	Process
804	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe
804	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe
804	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe
1940	AKL.exe
1940	AKL.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\AKL.001	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe
File created	C:\Windows\SysWOW64\AKL.006	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe
File created	C:\Windows\SysWOW64\AKL.007	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe
File created	C:\Windows\SysWOW64\AKL.exe	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64	AKL.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AKL.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1940	AKL.exe
Token: SeIncBasePriorityPrivilege	1940	AKL.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1940	AKL.exe
1940	AKL.exe
1940	AKL.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 1940	804	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe	30
PID 804 wrote to memory of 1940	804	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe	30
PID 804 wrote to memory of 1940	804	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe	30
PID 804 wrote to memory of 1940	804	JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a8c67e17555024b5078654d5d0934870.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\AKL.exe
  "C:\Windows\system32\AKL.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\AKL.001

Filesize
1KB

MD5
0ea09a09baf17db687cebc7fade0ea34

SHA1
1aaa1b1010e4d2c8c76c1307e36c77e6b2c870c7

SHA256
d34d1d0f1dd8ab1d42d52d07afb4fe3a6373bd28d57c6416407d7605bdf5ad9b

SHA512
d9c9d7d50ddcfb17de8046c96db3d5ce73626ac4356ced663ade30cdccb7a8b00ad83684791ed4de84c174d117c881e441d95f1ed25fbc2c297b256cf461233f

Download Submit
C:\Windows\SysWOW64\AKL.006

Filesize
4KB

MD5
1153fe5fbe61266713539cae72d87ad3

SHA1
245047d3d158f4eda34290ed22e4bb13a28f9539

SHA256
3b2700a8033916afd0e89ab5519702720f35b94a570ebe865df113f2aacda16c

SHA512
24058cdebaf8ccfc00622301927b221116b846c2a8acf8f0935ba30e0d716bfecd6ab07aaf8d93030ec2149ee98eec5f6d2395ee8a1a62ad00e07124447c107c

Download Submit
C:\Windows\SysWOW64\AKL.007

Filesize
6KB

MD5
049989542b610261bde51aff6b71d4aa

SHA1
22de68b6548faf1ec1b52f14a1f197fa5152babd

SHA256
48cabcd5da354d4018809d12ca445c4c6324250f22450aca04222c214b9ae42d

SHA512
8cc0cb8167598e50a91230061cbe12d0d724151dc454f6cf0dcd5074efc704602796a9a136e53f609a6d54ad6c468aff2db263ad72b4b7d7febd32656eece34c

Download Submit
\Users\Admin\AppData\Local\Temp\@A8BD.tmp

Filesize
4KB

MD5
de3f9e4f680ff22e8712fa9b32ff85ee

SHA1
0cc885ed6502b3b610af57ee2095410751d9dd78

SHA256
477f789ffe931ee11197de814231fdc770e6e6c1e94b0fec5bee0adecd32dd03

SHA512
daf04bb16fec1130dc08e72b7f28b0041b2eb78900e1464e15f1e20e1705a0de24d3df0de8111a42aed03d73db6f8eb5e30c87f34b4a745d4aa27d84e09d9f90

Download Submit
\Windows\SysWOW64\AKL.exe

Filesize
231KB

MD5
79c6903c4794af027053331946137b26

SHA1
b688916709014fc874c5b7870553105a9961c652

SHA256
f3cbf3dd3f229f6119a8be5357959b77af1a43f9d568a7febe9a06f7593b20ed

SHA512
ac28813dcdc38ff1b0736b1673ced7e35d7da5667b0224b88952908564373ae61aff1b0f03d27e40b613559c8d4e37c402269791db2ed1311f62d069a2e5111e

Download Submit
memory/1940-23-0x00000000751A1000-0x00000000751A2000-memory.dmp

Filesize
4KB

Download
memory/1940-24-0x00000000751A0000-0x00000000751CA000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing