ardamax | 8d7a45535e6d97ae9e1fc1913effad1ee3d4e42734ffcd0f14ea96d988e417fb

General

Target

JaffaCakes118_75c568792986ed590151d4636eec2b28.exe
Size

424KB
MD5

75c568792986ed590151d4636eec2b28
SHA1

e6ae10d6c0d6dbf260c1cde407c5683d9e69472f
SHA256

8d7a45535e6d97ae9e1fc1913effad1ee3d4e42734ffcd0f14ea96d988e417fb
SHA512

0062f6f04744f68e75a6a911eac0543e547aa234a5c28a03cc1104d736d9ac2e05939f7436893221a8c1de2710d886143ec6966f9c85b59f38f03e9fcd940ecf
SSDEEP

6144:xRdo3kYeO2bYZRaC6CyQk7qIOvFtC2vJuqVAGF8Tq5bDt2vDdwYZFeExu0dF6UWx:xombYKC3IOLb7yqodweeEEaFDWqDe

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00050000000194d0-20.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2892	Installwed20.exe
2348	VDKS.exe

Loads dropped DLL 16 IoCs

pid	Process
2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe
2892	Installwed20.exe
2892	Installwed20.exe
2892	Installwed20.exe
2892	Installwed20.exe
2892	Installwed20.exe
2892	Installwed20.exe
2348	VDKS.exe
2348	VDKS.exe
2348	VDKS.exe
2348	VDKS.exe
2348	VDKS.exe
2812	DllHost.exe
2812	DllHost.exe
2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe
2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VDKS Agent = "C:\\Windows\\SysWOW64\\28463\\VDKS.exe"	VDKS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\VDKS.001	Installwed20.exe
File created	C:\Windows\SysWOW64\28463\VDKS.006	Installwed20.exe
File created	C:\Windows\SysWOW64\28463\VDKS.007	Installwed20.exe
File created	C:\Windows\SysWOW64\28463\VDKS.exe	Installwed20.exe
File opened for modification	C:\Windows\SysWOW64\28463	VDKS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installwed20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VDKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2348	VDKS.exe
Token: SeIncBasePriorityPrivilege	2348	VDKS.exe
Token: SeIncBasePriorityPrivilege	2348	VDKS.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2812	DllHost.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2348	VDKS.exe
2348	VDKS.exe
2348	VDKS.exe
2348	VDKS.exe
2348	VDKS.exe
2812	DllHost.exe
2812	DllHost.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2892	2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe	31
PID 2708 wrote to memory of 2892	2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe	31
PID 2708 wrote to memory of 2892	2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe	31
PID 2708 wrote to memory of 2892	2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe	31
PID 2708 wrote to memory of 2892	2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe	31
PID 2708 wrote to memory of 2892	2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe	31
PID 2708 wrote to memory of 2892	2708	JaffaCakes118_75c568792986ed590151d4636eec2b28.exe	31
PID 2892 wrote to memory of 2348	2892	Installwed20.exe	33
PID 2892 wrote to memory of 2348	2892	Installwed20.exe	33
PID 2892 wrote to memory of 2348	2892	Installwed20.exe	33
PID 2892 wrote to memory of 2348	2892	Installwed20.exe	33
PID 2892 wrote to memory of 2348	2892	Installwed20.exe	33
PID 2892 wrote to memory of 2348	2892	Installwed20.exe	33
PID 2892 wrote to memory of 2348	2892	Installwed20.exe	33
PID 2348 wrote to memory of 2692	2348	VDKS.exe	34
PID 2348 wrote to memory of 2692	2348	VDKS.exe	34
PID 2348 wrote to memory of 2692	2348	VDKS.exe	34
PID 2348 wrote to memory of 2692	2348	VDKS.exe	34
PID 2348 wrote to memory of 2692	2348	VDKS.exe	34
PID 2348 wrote to memory of 2692	2348	VDKS.exe	34
PID 2348 wrote to memory of 2692	2348	VDKS.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_75c568792986ed590151d4636eec2b28.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_75c568792986ed590151d4636eec2b28.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\Installwed20.exe
  "C:\Users\Admin\AppData\Local\Temp\Installwed20.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\28463\VDKS.exe
    "C:\Windows\system32\28463\VDKS.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\VDKS.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2692

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\School on fire.jpg

Filesize
127KB

MD5
a607701e6e05f2b304cb7fcd3cf24012

SHA1
6d526e42036e52711b5a5e89c90f311948ed6aa9

SHA256
e7e729586d1664cd091c7ebb3c5dd26b6f8808106a52e9fc91e5e993a42b4a60

SHA512
097d7af85dfb3f8f18f022fd5b613bfd4d409d6b32be15a4361ca42ba60d215f307cda45d72855abb9c59faea2e38b6fa1b36b5738797e5c931ec3aa54011203

Download Submit
C:\Windows\SysWOW64\28463\VDKS.001

Filesize
416B

MD5
6b5c4cd4285e952d51ea2dca68d7f1df

SHA1
dfc6c57703ee0c563466f2bd053ea407a631579f

SHA256
f28ffee59e1dd027bea4b723809f6240a57035982e07b4f7c75152b3d9c7af55

SHA512
a74d078b8371d8f9b94cba104d8aea6d0a67fcd9cf79cbbdb385d9c44a47fbdfa76ef4a53550c78ca52f1d83136e670983c127a7a98f5de2c9a90e5c181519fa

Download Submit
C:\Windows\SysWOW64\28463\VDKS.006

Filesize
8KB

MD5
aae8ccee5d5eed5748d13f474123efea

SHA1
6da78da4de3b99a55fad00be2ec53a3ad3bd06ae

SHA256
10c464d1675774e0282171555d59fb8975ed6c0e6a781182490f48e66823a5b8

SHA512
d370e1ffeeb81b3f07b83a9cf1e3b44635fde7aa6ac999bccafece8091dbf96f0a78257bb0e03b3689dc47fb4e96ec7deac7848a43ddef62afc9b8cc665ee8bd

Download Submit
C:\Windows\SysWOW64\28463\VDKS.007

Filesize
5KB

MD5
40685d22d05d92462a2cfc1bba9a81b7

SHA1
f0e19012d0ed000148898b1e1264736bed438da8

SHA256
cdca1e5bc4c5129caa8eeddf637c820b6241c8790ce1a341e38e8324ae95afa0

SHA512
21961d2dd118b45bde4cf00b4570712791a22769d05afb5b6c54355b0aaee9b7f7de00b357845349ef957807452365134d51e11181d2d45f98ed0cc9402de90b

Download Submit
\Users\Admin\AppData\Local\Temp\@ECDE.tmp

Filesize
4KB

MD5
27092ec75c1839f36bfe900a38acc484

SHA1
fe14b750a0ed653246c5f358891f8c1241913bb2

SHA256
e6e29699840ae26c452227f9a1c9fd0e3cda0c2413c4255df9fc066c47af0e07

SHA512
815477e8681e38dd3110171adbaf06738eb9d63839671a959a296ec1a1fb17d788682dde5e6a1f0bffa3b4deda4577292ffa37ce10b95ad14276ffcd0795ac0b

Download Submit
\Users\Admin\AppData\Local\Temp\Installwed20.exe

Filesize
294KB

MD5
7ee9df4741965d2d0f4bf757f033fac4

SHA1
803568ee140eb3348c31f75a453b26b8a9dd6a9f

SHA256
9310d2afdfe89f2ed31c25e944cdca379f8d038880b2f5775c45d0d15d436fec

SHA512
8ca20cea2d63eec8bed830874793db0d170d306e3706f9637cb295119f7dad93f34f3949288a85cd027c109b3782d1fcf522c2309548a3332559bf688f5c7ca8

Download Submit
\Windows\SysWOW64\28463\VDKS.exe

Filesize
473KB

MD5
339ae4ce820cda75bbb363b2ed1c06fd

SHA1
62399c6102cc98ed66cbcd88a63ff870cf7b2100

SHA256
1e4a463ac0d463cee1f52f9529474484157c85d671aea1ab5f4173df12de01b6

SHA512
5da8b333a839c4b169c6f4c9a1929918f166a895af7818c8223df7ed22279aac3b6ef88f89ee083a4f475f82ec6078f8e9800a9afc9547712245d090636a284a

Download Submit
memory/2708-33-0x0000000002B40000-0x0000000002B42000-memory.dmp

Filesize
8KB

Download
memory/2812-34-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads