ardamax | 975a1879f367292ddccd98cce6b310e52c91e4f67b72126fb991f3cf0500d18c

General

Target

0249b558f268587e1b571f95133bbf27_JaffaCakes118.exe
Size

1.6MB
MD5

0249b558f268587e1b571f95133bbf27
SHA1

06687d0774897f1ade45069b73c53e4034af674e
SHA256

975a1879f367292ddccd98cce6b310e52c91e4f67b72126fb991f3cf0500d18c
SHA512

b16c53badd6dfea38c9ecbd14c70e42ba0261819fc7f9f12b7d8ad36e900801d332e2871700ed7d8588513c5d495a113031f8a041e7a22228cee383e3b2125d1
SSDEEP

24576:rFat3bciItaFjGCqEMSHBN+GS/LTUw23Yjw:I

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233f0-28.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	tmp.exe

Executes dropped EXE 2 IoCs

pid	Process
4204	tmp.exe
3952	LHGM.exe

Loads dropped DLL 4 IoCs

pid	Process
4204	tmp.exe
3952	LHGM.exe
3952	LHGM.exe
3952	LHGM.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LHGM Agent = "C:\\Windows\\28463\\LHGM.exe"	LHGM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\28463\AKV.exe	tmp.exe
File opened for modification	C:\Windows\28463	LHGM.exe
File created	C:\Windows\28463\LHGM.001	tmp.exe
File created	C:\Windows\28463\LHGM.006	tmp.exe
File created	C:\Windows\28463\LHGM.007	tmp.exe
File created	C:\Windows\28463\LHGM.exe	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	0249b558f268587e1b571f95133bbf27_JaffaCakes118.exe
Token: 33	3952	LHGM.exe
Token: SeIncBasePriorityPrivilege	3952	LHGM.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3952	LHGM.exe
3952	LHGM.exe
3952	LHGM.exe
3952	LHGM.exe
3952	LHGM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 4204	1928	0249b558f268587e1b571f95133bbf27_JaffaCakes118.exe	85
PID 1928 wrote to memory of 4204	1928	0249b558f268587e1b571f95133bbf27_JaffaCakes118.exe	85
PID 1928 wrote to memory of 4204	1928	0249b558f268587e1b571f95133bbf27_JaffaCakes118.exe	85
PID 4204 wrote to memory of 3952	4204	tmp.exe	86
PID 4204 wrote to memory of 3952	4204	tmp.exe	86
PID 4204 wrote to memory of 3952	4204	tmp.exe	86

C:\Users\Admin\AppData\Local\Temp\0249b558f268587e1b571f95133bbf27_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0249b558f268587e1b571f95133bbf27_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\28463\LHGM.exe
    "C:\Windows\28463\LHGM.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@562E.tmp

Filesize
4KB

MD5
a55cbc0f0125b005ef369020b4c17806

SHA1
010af3e2e84b337e91f5e0c791b01e1d527211ce

SHA256
27cfe74936e4090aafbef07ee45725923f4b1243135e1e3a51e3385dbcd7b637

SHA512
88e5f7905c86d73bc5af028f20c8bf49f700307926c5b92814c245abe08e9c35841116d428ddbd7b957b47ccc8980684c12608b6818e4b6c1c8c0d27d54a07be

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
818KB

MD5
a71d2bdada352de9fba2ece18a9aad67

SHA1
4e95004fcc16c4ca4eca7e0413d0655848a84893

SHA256
d95681e148125ff7a77031d8e01b995b20e12e283380bf85b90eb3ac7c695bc4

SHA512
66ff570de11aea9411b3a53f4a2d989f2dca4e7ffeb706e7aedec3f87ae40f99dd9e57d951b521df3c90a9ddafae7169b449059a1315ca8d92bb8b27f99d2ec2

Download Submit
C:\Windows\28463\AKV.exe

Filesize
457KB

MD5
46ccfd974518e5849738449034a05a17

SHA1
d391108816aed7ba8f7beb205ad7171c74eae6b2

SHA256
571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe

SHA512
773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a

Download Submit
C:\Windows\28463\LHGM.001

Filesize
438B

MD5
4fd2f6f0864344cd80aa8aaa38b37bf5

SHA1
ac0ee1d8027726e1ba605a6112af4cd67be26e61

SHA256
5fd04cddbacaff0565eabc8dbe8bfb42ab3ad4d2e74b3ee32977c191981730fc

SHA512
a78fee1045d75a06023fe21e510091604408e1e5580e4b6336847baf4cf914acd5d5d1fe7430fb0e25de0c9edcce994410f89e081e78b2f039c0167c908e6ad2

Download Submit
C:\Windows\28463\LHGM.006

Filesize
8KB

MD5
395bbef326fa5ad1216b23f5debf167b

SHA1
aa4a7334b5a693b3f0d6f47b568e0d13a593d782

SHA256
7c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1

SHA512
dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679

Download Submit
C:\Windows\28463\LHGM.007

Filesize
5KB

MD5
1b5e72f0ebd49cf146f9ae68d792ffe5

SHA1
1e90a69c12b9a849fbbac0670296b07331c1cf87

SHA256
8f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e

SHA512
6364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc

Download Submit
C:\Windows\28463\LHGM.exe

Filesize
912KB

MD5
6768ba61744862704760b66ce8f8fdd4

SHA1
e86cbed8cf20c2a9c76219d0c434bc310ffb2392

SHA256
4cf4bf2b7d2bb4215e255e1f2b1238ad989f3c8a98ebfd5cb033bccf32fedaa0

SHA512
eadb56b633707724ef4f47f8b421b0f3b2afa5a9800fae030f81aefae483eed6b494da470278273f388c3ae346a33cbbfe742924d231dab1c9b42bbefaf95a61

Download Submit
memory/1928-4-0x000000001B980000-0x000000001BE4E000-memory.dmp

Filesize
4.8MB

Download
memory/1928-6-0x000000001B4A0000-0x000000001B4A8000-memory.dmp

Filesize
32KB

Download
memory/1928-5-0x000000001BFB0000-0x000000001C04C000-memory.dmp

Filesize
624KB

Download
memory/1928-0-0x00007FF8AF435000-0x00007FF8AF436000-memory.dmp

Filesize
4KB

Download
memory/1928-3-0x00007FF8AF180000-0x00007FF8AFB21000-memory.dmp

Filesize
9.6MB

Download
memory/1928-7-0x000000001C110000-0x000000001C15C000-memory.dmp

Filesize
304KB

Download
memory/1928-2-0x00007FF8AF180000-0x00007FF8AFB21000-memory.dmp

Filesize
9.6MB

Download
memory/1928-1-0x000000001B3F0000-0x000000001B496000-memory.dmp

Filesize
664KB

Download
memory/1928-42-0x00007FF8AF180000-0x00007FF8AFB21000-memory.dmp

Filesize
9.6MB

Download
memory/3952-35-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3952-41-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/3952-46-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3952-47-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads