ardamax | 263e3f3ff7b18c8a84e908b86ed3c01199db505e6a2e75585105c0b6958fbeab

General

Target

JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe
Size

955KB
MD5

1031bf738894f59020763eaaa5c2b793
SHA1

ae42eaa1cea4950e8c75dce144ef2d5553fe46cf
SHA256

263e3f3ff7b18c8a84e908b86ed3c01199db505e6a2e75585105c0b6958fbeab
SHA512

9bb25e647b70191cbb52b4634214d4a01a3874398c8e8b18e25880602c6751e3a9a3b9221bf415e2da9f6ce328bac7c9913fa9377830face0067a6f57b99896d
SSDEEP

24576:p0NzTGDvC2dOosk7kzDnYRiKau/vplBEWuQMUvs:p0pTW3dOoRkfYMC/zBEW

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016cec-8.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2824	UDS.exe

Loads dropped DLL 2 IoCs

pid	Process
2700	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe
2824	UDS.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDS Start = "C:\\Windows\\MBSJRS\\UDS.exe"	UDS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\MBSJRS\UDS.001	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe
File created	C:\Windows\MBSJRS\UDS.002	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe
File created	C:\Windows\MBSJRS\UDS.exe	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe
File opened for modification	C:\Windows\MBSJRS\	UDS.exe
File created	C:\Windows\MBSJRS\UDS.004	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UDS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2824	UDS.exe
2824	UDS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2824	UDS.exe
Token: SeIncBasePriorityPrivilege	2824	UDS.exe
Token: SeIncBasePriorityPrivilege	2824	UDS.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2824	UDS.exe
2824	UDS.exe
2824	UDS.exe
2824	UDS.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2824	2700	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe	31
PID 2700 wrote to memory of 2824	2700	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe	31
PID 2700 wrote to memory of 2824	2700	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe	31
PID 2700 wrote to memory of 2824	2700	JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe	31
PID 2824 wrote to memory of 2736	2824	UDS.exe	32
PID 2824 wrote to memory of 2736	2824	UDS.exe	32
PID 2824 wrote to memory of 2736	2824	UDS.exe	32
PID 2824 wrote to memory of 2736	2824	UDS.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1031bf738894f59020763eaaa5c2b793.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\MBSJRS\UDS.exe
  "C:\Windows\MBSJRS\UDS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\MBSJRS\UDS.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MBSJRS\UDS.001

Filesize
61KB

MD5
0e7e847fb96b4faa6cb4d3707a96887e

SHA1
896fd4064044e271312e9128e874108eec69521f

SHA256
c0f3e18ed0020dae5f75d3338b51f9c8de26d8af0a4d31904ba77cb1d112bbca

SHA512
ad680ed30b0cabe1be4e7237b8e620060de9c5f64d088d21a6acf6f293551ab4abc10f8f959aa6041e19aeaea538e72beeecc29b7669546a9a151141d4e73684

Download Submit
C:\Windows\MBSJRS\UDS.002

Filesize
43KB

MD5
f195701cf2c54d6ceadad943cf5135b8

SHA1
9beb03fc097fc58d7375b0511b87ced98a423a08

SHA256
177c1dcc7f13158445f0b99713e9cad205da86e764940a48d43dc375565b0dec

SHA512
f78def1ab431bb2b7b647ec76c063c30a87cabd22605f94cbe4fbb6f757fd54ddf7861d3842a0e369abfce94b68d41dec0fe2322a74f67d9875f561f92b20025

Download Submit
C:\Windows\MBSJRS\UDS.004

Filesize
1KB

MD5
12b85ce466ffdc5172949d97b578c5ef

SHA1
d33725167bf7fa6607985938afa335e2cfc1eb71

SHA256
9b3097bfdd69d1c54d18b5d4214e19b112bf45b7df42a0639e2724cd59174202

SHA512
23a3b8694d00d583d8fa2236210bf6c1cc6be91a4d2eb92c7bd5247fcc5f7b822c6ad134a8bac0f52e97346d904f54e9486bf21665b97013aa7886a8987e104e

Download Submit
C:\Windows\MBSJRS\UDS.exe

Filesize
1.7MB

MD5
d95623e481661c678a0546e02f10f24c

SHA1
b6949e68a19b270873764585eb1e82448d1e0717

SHA256
cecfadce6fb09b3977c20d15fb40f8f66a1d7e488a4794451d048a598c3417da

SHA512
dee02644d92ed30e88bb10e9dcdba97abd9949b230059ec20cf5d93061f9cdb77b1e793e5f69d0b51595c30077c3ddd093348d22b070ce898ccefe28b8062591

Download Submit
memory/2824-13-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2824-15-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads