ardamax | 59d57c009c84e06bb30011625c0f3308a56d6a0f2b05b204f0b7ede9a34d09bf

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe
Size 557KB
Sample261006-sqlx5ah16x
SHA256 59d57c009c84e06bb30011625c0f3308a56d6a0f2b05b204f0b7ede9a34d09bf
MD5 562c3b9a9dc44a483b5e408470e03200
SHA1 d9f1adb682ccb19ad7e5c912a01a989a946c99da
SHA512 0813c5dbe2f3a5f4dc269819f9f872ec3ba8687b2d8367c7d3273e2ccb2d903f717a33c202b64f57e8ada8f17f20a2bc13e84dba2c1dd33794d83171896c426b
SSDEEP 12288:nRXewp/Xdkg+mB42eEuIq/1ByPSJeG5umOBLX0SrzoZ/6p:0g/XC44AuZ/1yYeXmOBLoZ/6p
TLSH
T185C4F1466236F1E0D42CC8731D1771FA2BCA1D619D0BAD257118FF3778721E4AE2A62B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery ardamax keylogger persistence stealer

Malware Config

Signatures

Family: Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4f1-11.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
4680	TFTW.exe
4620	TFTW.exe

Loads dropped DLL 5 IoCs

pid	Process
5016	jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe
4680	TFTW.exe
4620	TFTW.exe
4680	TFTW.exe
4680	TFTW.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TFTW Agent = "C:\\Windows\\SysWOW64\\Sys32\\TFTW.exe"	TFTW.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Sys32\TFTW.001	jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe
File created	C:\Windows\SysWOW64\Sys32\TFTW.006	jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe
File created	C:\Windows\SysWOW64\Sys32\TFTW.007	jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe
File created	C:\Windows\SysWOW64\Sys32\TFTW.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe
File created	C:\Windows\SysWOW64\Sys32\AKV.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe
File opened for modification	C:\Windows\SysWOW64\Sys32	TFTW.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TFTW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TFTW.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4680	TFTW.exe
Token: SeIncBasePriorityPrivilege	4680	TFTW.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4680	TFTW.exe
4680	TFTW.exe
4680	TFTW.exe
4680	TFTW.exe
4680	TFTW.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4680	5016	jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bcw.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\Sys32\TFTW.exe
  "C:\Windows\system32\Sys32\TFTW.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4680

C:\Windows\SysWOW64\Sys32\TFTW.exe
C:\Windows\SysWOW64\Sys32\TFTW.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@1524.tmp

Path C:\Users\Admin\AppData\Local\Temp\@1524.tmp
Size 4KB
SHA256 5110301dee966f0f26307ab1b430279d1e4999c2c4a0ea924ff32f1a9ded869a
MD5 33303ca8abef9221cb410b8a232e9fe4
SHA1 0cdfc25dbf0e9ad7d4585cd9037dc2e6604be00c
SHA512 da29821045773ba776def985966b62e09e69bb5bf1786b16c2fff6feb68a03b9e22c5f7d081e3dd58d1785cd7ac64736497c043b7cf6c7149c3a54f8ef111800
TLSH
T19A81743B37C855B3D2478B33309B05D6B7A4A3304765445C8DB30B032A666DFC82CB42
MD5 SHA1 SHA512 TLSH

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\Sys32\AKV.exe
Size 391KB
SHA256 992cb5ea845b2d24c02f4e40873bf4ebd7b58b57ae2e001907228af4879e575b
MD5 869461e168a87283a8782e70f5d5a3a8
SHA1 ab189b5f2682ae66162226b4f646b1e80486c653
SHA512 e4e77e07eb0ef2adb6d5ebdb9629f4632c417cf3d1a22e4c414b806bfbd259df13f6c88265f9346ed2b22bf67eb3d63924d86767c8508be4abdc9067f15a82ae
SSDEEP 6144:UXZb4iCtpkwEB+5fbW8A/Y/aYcbLrLlPh1/fVD8IlG:wbCpiBufi8A/93bLBi
TLSH
T1F284CF00F6D1C0B2C4EA11B00947A7799B75BF92173A85F7B7D43E4AA9317E2AE35306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TFTW.001

Path C:\Windows\SysWOW64\Sys32\TFTW.001
Size 458B
SHA256 7d210addbdf270f58f32c4709969211a23ffbed059e6cfec4c3c2815d098179b
MD5 6a9c99aa7d8fe61205b26248cd127094
SHA1 f89430574a834660bf49bcdfdc39d7105a538180
SHA512 6db233766b3098efd3e20d45f64763543d8ac56c42f3b453fe6ee4b7e13be31ed27859e9220969f47159fc1c6a5442f8dc34bf1ead22aaca6ea255d92e1be184
TLSH
T1A6F05A4056A38C4956C042CC6CA53591BDC1EC1AA4F3BD01BAD525206D838E82CE3F0D
MD5 SHA1 SHA512 TLSH

Submit Download

TFTW.006

Path C:\Windows\SysWOW64\Sys32\TFTW.006
Size 7KB
SHA256 e3473d81a02ed30e4236591384136f41f17b6a4aae24b5468789644ccd4bf192
MD5 928cc65dc793834c709a054ca57c19c8
SHA1 a1e5d8407199c1bd6a4b274044de640fe0d9e99b
SHA512 f7c8f7a75c4f8a418630e2ac15676740a902449d9a3c4baf3184409f8701c9caa3e82304d141362d95503f1af6b693eed7b77f690d92ca0162f7ea3ecbc80fdf
SSDEEP 96:6Xjzh3mt3uKUMZfX0FIx+GXXQYfR+cwMswHO1AEIQoWkQD/jHRP2mIXT6pDKL9:UB3mR0ymIx9XgY5c1ItWkgRyD6pWL9
TLSH
T1DFF1E832638209F3DBAA16F25893263A476F5511AB9045E38B931ED06D611D3EF34F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TFTW.007

Path C:\Windows\SysWOW64\Sys32\TFTW.007
Size 5KB
SHA256 f49448fc7c567e64eaeb9cc4dbd3c8021a82b5d9df0a622a439f7b42dc2f26d7
MD5 3e1f5d5a06cf97b0495b8d129fbe02e4
SHA1 b0de258a813f5edde85004f6865b6ed91f6d6f8f
SHA512 b0e0b81cb5776d298e96346aa61027c9799a47191c94de50be2209c32747774959d002ddeb98fd15556ee893b0d7bd1f0c8a901469dce4e3acf94e2c4c3e2bfd
SSDEEP 48:6gklbzA6wUQEEiD4rAKaKzl/a4nOAeiPAIaiFcBakgkHOLo:6gSxDEl/a4n7eiIIaihsHOLo
TLSH
T1F7C18333F3D504B3E65B42B6699A04EB7ABA71304BA2040A0CD31156296AAA3DF3D713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TFTW.exe

Path C:\Windows\SysWOW64\Sys32\TFTW.exe
Size 476KB
SHA256 39d8bdb975fbfcbcec8fe63be4e9fe6ce39ae5d23a005118aeffa07b17a3f815
MD5 ef52b540cb404d908338e9cbf7cff283
SHA1 778765e1736c0a197685978c3fee7a44e7bde419
SHA512 596b77bf5b15455c326a5a2efd66bc69685eb625e3e211ea0341ad4d8920ada7618a7107e42f2c0963fe6c2d92f2acf47b641ef33071a7c42004e5874d5219a6
SSDEEP 6144:S6q0NG7h0Fv29+eLUpbNduqhLUyccZh6XGks/YVeNZsmxMlAL:J40kUpm8LUO6WjrfL
TLSH
T112A4AE0072E1C0B2D4F706B01C67A7658B75BE6117358AC777E86E4A7D316E2EE3A342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4680-23-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/4680-29-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads