ardamax | a98decf0febd1dd8f5f11da1a3beebead573ff70ca168203e5714388529d9a32

General

Target

JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe
Size

1023KB
MD5

aa3b6f93127cef80c8a6263156aa253f
SHA1

ddc5d38de0b2ff6661894cd7226c265c1a49eea9
SHA256

a98decf0febd1dd8f5f11da1a3beebead573ff70ca168203e5714388529d9a32
SHA512

c852c3a00d5370ae9f9fd631bb5ff2e0c52456ae55ad19e1cdffab4b40cc8809d658f3f562275f31e49c19bc4eda7b3cfbb959c8e98ea3908aa5366fd876adea
SSDEEP

24576:LbPTNNGRWmlgU4LB4g2dyzvRBwQS/g2gB7hddPw2y:L7TNsR3GLmHdip7S/DgB7O2

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c5e-8.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\International\Geo\Nation	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe

Executes dropped EXE 1 IoCs

pid	Process
4260	TTR.exe

Loads dropped DLL 1 IoCs

pid	Process
4260	TTR.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TTR Start = "C:\\Windows\\SysWOW64\\GIELPJ\\TTR.exe"	TTR.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GIELPJ\TTR.004	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe
File created	C:\Windows\SysWOW64\GIELPJ\TTR.001	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe
File created	C:\Windows\SysWOW64\GIELPJ\TTR.002	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe
File created	C:\Windows\SysWOW64\GIELPJ\AKV.exe	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe
File created	C:\Windows\SysWOW64\GIELPJ\TTR.exe	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe
File opened for modification	C:\Windows\SysWOW64\GIELPJ\	TTR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TTR.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4260	TTR.exe
Token: SeIncBasePriorityPrivilege	4260	TTR.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4260	TTR.exe
4260	TTR.exe
4260	TTR.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 4260	2184	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe	84
PID 2184 wrote to memory of 4260	2184	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe	84
PID 2184 wrote to memory of 4260	2184	JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe	84

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aa3b6f93127cef80c8a6263156aa253f.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\GIELPJ\TTR.exe
  "C:\Windows\system32\GIELPJ\TTR.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\GIELPJ\AKV.exe

Filesize
439KB

MD5
21790fb1d4da6b68e84fc3f48a8df97e

SHA1
7a22bcbec27ac9b17cde3eee943b352a4e344750

SHA256
c6cb4175a0397429ff692a3d67e020f4a91b4ed5b4b0cad19952f9afdbefef80

SHA512
623eafceddd5bbf17c359b3f3c56380113aa73b9b6e799b796913a9093993d635313d673a3c49d424716bb0ba1aba18a7023cdf2f5675fbf4d67319e81437699

Download Submit
C:\Windows\SysWOW64\GIELPJ\TTR.001

Filesize
61KB

MD5
169dd4f773e1145c60ea267daf59aa2a

SHA1
32fcf6bb45c30b733cb99afbafa407c192b51adf

SHA256
8d5f5284b914c54f78c161f5e018769c91a5cf284ffc169634c8b93b1f857294

SHA512
28ec0eceed4effec9960fc0ea0dc3b58f6b9d3b366db08ab26fef462c5ec919ac729c191599ffb5691bd2f2b5b5c59f88b9fb2b7e096fc36d78c612398f45295

Download Submit
C:\Windows\SysWOW64\GIELPJ\TTR.002

Filesize
43KB

MD5
4ae30112fb88a3afe5cb43da0a19bdfa

SHA1
dad87b56c59f2e50429cc246583c0b4c3fb6762f

SHA256
3593eba373f8359b1b2645640763677197eb46e57f7920ab105cd4ce312e02dd

SHA512
6f7051f711531bea909cca967c42846364c1bb2c5204c4780de2a9fe57bde81e053d953230aa95a54f24921368e23c6634ec31db6bf4462c97f3edbaeec82db1

Download Submit
C:\Windows\SysWOW64\GIELPJ\TTR.004

Filesize
578B

MD5
5021086a30c178b7b0d4b51795b93dde

SHA1
dcd1f3de9124f1ba29992707def53aa26ed37f55

SHA256
fd73ad7046f18b00cb7c144f05dcba5b595420e46b9de49fd50a54480c1441c0

SHA512
ed0bb7fa3858f1b474fce87ab7710088710674671c115b1cb48ce4885a8c2a97b1dfd8cece464200f3774fdbb1442a0a6d74ef0a03311b8afba734fad9ecd954

Download Submit
C:\Windows\SysWOW64\GIELPJ\TTR.exe

Filesize
1.4MB

MD5
0ce57a2394468e2ddd6beb22f528962c

SHA1
a51af8f0d75512f7dd8724700726154a0612e3b8

SHA256
c7169036f7194d4183828c524d6bf3011274fe98dd3a1a07411cd9b3b90968c8

SHA512
5cf75bde051ecfa8f5fcf1c009ad94b312c6626a354b764de4ab22b1ecc3136d74c74af6262439285715c864e6993866ed9b4ef2b919ea9510fa281b19996f02

Download Submit
memory/4260-16-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4260-18-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads