By Uriel Kosayev (@MalFuzzer) and Nir Yehoshua (@NirYeho)
Last month, we decided to enrich our knowledge by delving into research of a popular hacking tool. We decided to go with one that was limitedly covered in the past. It is called — Ardamax Keylogger. In this blog post, we present the methods and operations analyzed, including the key capabilities of the infection mechanism. We will also cover what data is being collected and how. In addition to the infection flow, we discovered a vulnerability in the Ardamax Keylogger that may allow attackers to exploit the keylogger’s DLL loading mechanism.
The Ardamax Keylogger developers have an official website that gives users the option to buy their product or only use it for a “test drive”.
We tried to find out when they first started and the oldest sample we were able to gather was generated somewhere around the year of 2013. In addition, these old versions are easily detected by existing AV engines. However, newer versions are still in question. From a quick overview of samples uploaded to VirusTotal, we noticed that the developers successfully evade detection in most cases. The detection rates are not that great compared to the fact that Ardamax is a “noisy” keylogger with an extensive resume in the wild.
We’ve analyzed dozens of samples, from all versions we were able to find and discovered that the vast majority of them were vulnerable to the flaw we found.
The infection kill chain comprises of the following steps:
1. Execution of the dropper Ardamax.exe, which drops several files, including a randomly named DLL to the %temp% folder.
2. The malicious process Ardamax.exe loads the dropped DLL that is used to drop the keylogger files under a hidden folder in the system folder.
3. Finally, the keylogger DPBJ.exe is executed, logging keystrokes and capturing screenshots.
Size: 784 KB
Once a victim launches the dropper, Ardamax.exe executes its initial routine GetTemp_Path (sub_401230), which obtains the Windows %temp% path, for later use, as shown in the following screenshot:
By looking at the disassembly output from IDA, the GetTemp_Path function calls GetTempPathW to retrieve the system’s temporary folder.
The next routine calls CreateFileW. In this routine, Ardamax drops several files to the temp folder, including a randomly named DLL, as we mentioned earlier.
Using Process Monitor, it is possible to see the randomly named DLL being copied into the folder. In this case, the DLL filename is @F9CD.tmp:
Size: 4 KB
Ardamax loads the randomly named DLL using LoadLibraryW.
If the DLL load is successful, the dropper will call GetProcAddress to get the DLL’s sfx_main address.
The following screenshot illustrates the operation above in a dynamic execution flow:
Next, the dropper gets a string containing the system’s main directory, which is either System32 or SysWow64, depending on the system architecture. Then, according to a hardcoded string, the dropper creates a hidden folder with the hardcoded name “28463” and copies several files into it. The batch of files will include DPBJ.exe, which is the actual keylogger.
Once all files are copied to the designated folder, the main file of the keylogger dubbed DPBJ.exe is executed with ShellExecuteW:
The list includes the following files:
- DPBJ.006 & DPBJ.007 — DLL files that are loaded by DPBJ.exe in runtime.
- DPBJ.exe — Keylogger’s main executable.
- key.bin — Keylogger’s license serial key (Still in research).
- Other files didn’t seem interesting for our research purpose.
Using Process Monitor again, it is possible to track the behavior of the hacking tool and its use of the hidden folder. The screenshot below illustrates how the “DPBJ.exe” file is being called for execution:
Size: 646.5 KB
After the keylogger is executed, it starts to collect the victim’s keystrokes and screenshots.
In the following routine, the SetWindowsHookEx function is being utilized with idHook of 2 (WH_KEYBOARD) that handles keystrokes events and thus logs them:
Below, we can see the use of several WinAPI functions to capture screenshots in runtime:
Next, we see that the captured screenshots stored under C:\Windows\SysWOW64\28463 with the naming format of [Date_Hour].jpg:
Here is an example of how the screenshots are being stored under the hidden folder discussed earlier:
The interesting part here is that the keylogger (DPBJ.exe) loads DPBJ.006 and DPBJ.007, DLLs that call the WinAPI functions below:
- SetWindowsHookEx — Keystrokes logging
- GetDesktopWindow — Screenshot taking and more.
This can, in some way, make a researcher’s job harder while using dynamic tools, such as ProcMon, that have limited insight into the process’s behavior. Furthermore, it can also fool some sandbox solutions that try to intercept system calls to understand the malware’s behavior.
Also, we can see, the “DPBJ Agent” persistency logon object is created under the following registry element:
Using Autorun, it is possible to exhibit the Agent’s registry path and the executable location:
Note: New versions of Ardamax Keylogger have the same behavior in the system only with a different persistency path. It drops the keylogger files into a randomly named folder under the %ProgramData% folder which is also a hidden folder by default:
Eventually, the keylogger tries to communicate to a Yahoo-based SMTP server but the mailbox is unavailable (in this case):
Keylogger Exploitation — DLL Hijacking
As we wrote earlier, “DPBJ.exe” is loading DLLs with LoadLibraryW. In other words, it is looking for a specific DLL file name (in this case DPBJ.006 and DPBJ.007) to load them:
A lack of validation in the call to LoadLibraryW creates a possible backdoor for the generated executable. It allows for loading a DLL only based on its name, hence any third-party attacker can abuse this mechanism by crafting their own malicious DLL and replacing it with the exact name (“DPBJ.006”, in this example). In conclusion, when the DPBJ.exe is executed, it’ll load the replaced attacker’s crafted DLL.
To make it even more visual for you, we generated a PoC video where we show a live detonation of the keylogger to get a reverse TCP shell on the victim system:
Note: New versions of Ardamax Keylogger are also vulnerable to this attack including the latest version of 5.1 that was released in February 2019.
We saw that the Ardamax Keylogger has existed in the wild for over 6 years now. Although it’s been in the market for so long, secure coding practices were not part of the process, hence it creates more threats for infected victims. In addition, we saw a rather simple flow with features that are not unique enough to rate Ardamax as a strong offensive tool, but enough to evade some detections.
Indicators of Compromise
[Rand Name].tmp: D73D89B1EA433724795B3D2B524F596C
Related samples created recently