ardamax | 91a3d0a27502ce767f46347ca27bb61a98e48a1fb0c46146032655614ee7dd1f

General

Target

JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe
Size

481KB
MD5

bbd910ccf1ce3ce9387cb12e155906da
SHA1

bd4560936a47a8be0477ad71f2d57b23924ca1d6
SHA256

91a3d0a27502ce767f46347ca27bb61a98e48a1fb0c46146032655614ee7dd1f
SHA512

5872c3a08f7edd2ad0d6a76523bb986528842f8688a49a76d86a47d853f969041df725c31789b5b047a6b0432ff16df0c103cd5427845efe986debfd98cc656f
SSDEEP

12288:SRhe2z/VgX5qSj1oe2xyLO2ohMMiQ3hV7uZTnjOI/0B8yIrV:nq+jjJ2xyb6DqZjjx/0jc

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000241ef-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe

Executes dropped EXE 2 IoCs

pid	Process
4024	NSSE.exe
2848	NSSE.exe

Loads dropped DLL 3 IoCs

pid	Process
3096	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe
4024	NSSE.exe
2848	NSSE.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NSSE Agent = "C:\\Windows\\SysWOW64\\Sys32\\NSSE.exe"	NSSE.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Sys32\NSSE.006	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe
File created	C:\Windows\SysWOW64\Sys32\NSSE.007	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe
File created	C:\Windows\SysWOW64\Sys32\NSSE.exe	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe
File created	C:\Windows\SysWOW64\Sys32\AKV.exe	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe
File opened for modification	C:\Windows\SysWOW64\Sys32	NSSE.exe
File created	C:\Windows\SysWOW64\Sys32\NSSE.001	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NSSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NSSE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4024	NSSE.exe
Token: SeIncBasePriorityPrivilege	4024	NSSE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4024	NSSE.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4024	NSSE.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4024	NSSE.exe
4024	NSSE.exe
4024	NSSE.exe
4024	NSSE.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 4024	3096	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe	87
PID 3096 wrote to memory of 4024	3096	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe	87
PID 3096 wrote to memory of 4024	3096	JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe	87
PID 2992 wrote to memory of 2848	2992	cmd.exe	90
PID 2992 wrote to memory of 2848	2992	cmd.exe	90
PID 2992 wrote to memory of 2848	2992	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bbd910ccf1ce3ce9387cb12e155906da.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\Sys32\NSSE.exe
  "C:\Windows\system32\Sys32\NSSE.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\Sys32\NSSE.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\Sys32\NSSE.exe
  C:\Windows\SysWOW64\Sys32\NSSE.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@45D3.tmp

Filesize
4KB

MD5
ce1db3d8d9e4b75ff749d38ca718a257

SHA1
5c7cc462e57f623c7d7a8c2a47467afc4927b4a4

SHA256
885d61204eff764496c6813967c4b4097cba7fcfb72e9571faabf1f4b5d473d9

SHA512
f6ee073336493f315b9644bf89526584a2aa9595626b51580faf1184e76f18718b696658288634737a9581d7ae27f36653243263ad35f0c9459001ba9892b160

Download Submit
C:\Windows\SysWOW64\Sys32\AKV.exe

Filesize
391KB

MD5
d2a65f5bcd35a551de241ff7db55ee10

SHA1
4037d2c5d08dcf5e9dbad74b577cbab419335a99

SHA256
b6de4fd78f2f9ba6ab981d4edc5a820b8a23bd8a5fd7cf9188f18168d94154db

SHA512
492b078f31dd41b46a58fdc938d391e283e7a2f50a7a514497926ad2c68f426bda91459dcba5fddc07d18e2216c632d6561fa4deb28f1d570bd656d0c3b1c4b3

Download Submit
C:\Windows\SysWOW64\Sys32\NSSE.001

Filesize
504B

MD5
5c47113f2148c39b0c319934c80c9c1a

SHA1
ec80004278baeaa046bef8cfa4b8a92458a0cd27

SHA256
e44603f7b357b13eb73d59206c20fdfad685a4ec9c6608f67709acdb81aeee8e

SHA512
522b1deb73f2c2a03c3f715a8c734b5550d8f419c013bad5df46e489906ac1b0058b0abd52195f94f23594af1c560d3197e2ca5ad956a20c3215b0b05bb81f26

Download Submit
C:\Windows\SysWOW64\Sys32\NSSE.006

Filesize
7KB

MD5
f88c78041afe02325aaed6f171ef23cf

SHA1
7a502ed670e5148a3d43d90e6b225926e3455f0c

SHA256
f80f5ec2826fbcb1b7a0b40b77e520d00ce25be52fae068b947868bbe93a406e

SHA512
1370e3cdfaedfbaa4c9d4e58520e6242316a629b671fae0664944cbe40ca6ef22230e2ec5b06698f6f1a1464ce4a57881655b5358d987f578caf766ac7e8e75e

Download Submit
C:\Windows\SysWOW64\Sys32\NSSE.007

Filesize
5KB

MD5
7073fbcfe75154326946919c8f86ebc2

SHA1
ba81cf37f06826ad6617e97b5a47538251024b4c

SHA256
89e3eb1103d75072346d3b454cde5efa92d7bb6f89f2d972b18fe0becf6db4e2

SHA512
7e9fcfd14460eebd02093f560d3fca6a198fc0b5592c3905be2efadd9bfafa24277a5155a54e4eaecfdf5829068e41969b0b97f70f5969fd1efafccfa870ae7b

Download Submit
C:\Windows\SysWOW64\Sys32\NSSE.exe

Filesize
476KB

MD5
93285f6ebc9657feb0724435db46e246

SHA1
f7762091e7cc91e6007f273284a59f74c36ff104

SHA256
2d44177550adda3ae9d69e7f5bb51557a7d5b1c23902d84e5a2ce9c1fe079d15

SHA512
0992893a78a4a66eea62057207717f91154ea16ae140bc62878968703496106a953c55a35b6ece0d081d521ece62fa9607d56fcab28d33ffdea0e80f0aa76c8d

Download Submit
memory/4024-23-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/4024-27-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads