ardamax | ac2621f2351f146bb3e964104a5ad75e64e81a0721a32f18c5ff91c2f9f8ca72

General

Target

020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe
Size

292KB
MD5

020eb17ce0b49857bf93e3b327b27926
SHA1

0f1cc14214bc24c9e756d323f8b476ee7c24907e
SHA256

ac2621f2351f146bb3e964104a5ad75e64e81a0721a32f18c5ff91c2f9f8ca72
SHA512

58a5504cf666b40d34aff22ddd2c2882adbf30dc5acef1df42f2506fa765d9bfcf8953febf25b7ed4cd6e1c218cbb9e9bb0ff81833c145d2a5f8df76ea866fc7
SSDEEP

6144:Dov6cXr+LIlGAg71i+NrKU/NbnOdnh8fKdDd7zEFsOSonUajKuo6K5xba:UBXr2kghi+Nr9/VO5ISd7rn9O

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233cb-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1216	KQSW.exe

Loads dropped DLL 4 IoCs

pid	Process
380	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe
1216	KQSW.exe
1216	KQSW.exe
1216	KQSW.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KQSW Agent = "C:\\Windows\\28463\\KQSW.exe"	KQSW.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\28463\KQSW.001	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe
File created	C:\Windows\28463\KQSW.006	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe
File created	C:\Windows\28463\KQSW.007	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe
File created	C:\Windows\28463\KQSW.exe	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe
File created	C:\Windows\28463\KQSW.004	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe
File created	C:\Windows\28463\KQSW.003	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe
File opened for modification	C:\Windows\28463	KQSW.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1216	KQSW.exe
Token: SeIncBasePriorityPrivilege	1216	KQSW.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1216	KQSW.exe
1216	KQSW.exe
1216	KQSW.exe
1216	KQSW.exe
1216	KQSW.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 1216	380	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe	81
PID 380 wrote to memory of 1216	380	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe	81
PID 380 wrote to memory of 1216	380	020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\020eb17ce0b49857bf93e3b327b27926_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\28463\KQSW.exe
  "C:\Windows\28463\KQSW.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@4844.tmp

Filesize
4KB

MD5
fc0fea286539e5d84ccf49020ca3823b

SHA1
d43711c776edf9a07abed6bb95ed4a0e45e14d52

SHA256
2520256a587481813a5557e54a65f2fca97baee5df333102adfff2dbdabb4828

SHA512
70e1a5ec247d5e3057fe19f7f34b31ee7a79ab16dca73794829d9d81e3ed891881df424f7aa44b9424550574ab61c95d376163b16080aa7cfd61e986e6988ea2

Download Submit
C:\Windows\28463\KQSW.001

Filesize
394B

MD5
ccdb5cf680a7d7d05132d28d0764293e

SHA1
4d7030c5ad4d0f748a5cacfcfa6d1e60174a7970

SHA256
402b054471fefd00750682afbc795d16d5a37fdf1b0bd5facfe5b5a4a4a21a8c

SHA512
8cf89172d20eff9a04c33a02c54363dd201f2343246f1debf2f7312214deef4510d55dfbfc40e44e9800de921d7f08e9243c7d7a635b695926ebdcb62b01be06

Download Submit
C:\Windows\28463\KQSW.004

Filesize
14KB

MD5
846c650382b21143f5ae0826c5acf182

SHA1
c277aecc1d7a210ffc5f9b6f15fa9f90bf87eb10

SHA256
d2da80b7f3910c6047f9aec37002f75e60fec7d7203c4f8ed189c930fb1b6fd4

SHA512
957a1dcc0a5082b14ac0da2107da2fa0b6a4b7b67253fbb6fcaa2c52bd4ae1291436484b4709659e166190aadc5b7d34b4666475d8fe6f257e1666f232d94b3f

Download Submit
C:\Windows\28463\KQSW.006

Filesize
8KB

MD5
75f215af21ded98ab7a1a2a0ea1f1a30

SHA1
e85649693a178064da1aa4cc7c8e34c92472ba0d

SHA256
af46dca2a4f77f0c977fec74312a41e20bd064bd2ca17bec0f09afd67d7e1e3d

SHA512
1582847dae80134e5272fc1b125d6af13746263601ebc8b540ea5fd3e4fc0a05f6e783c59a6052b971efd15d26d9d55b86345292160e9c79041b7c57f9a74f54

Download Submit
C:\Windows\28463\KQSW.007

Filesize
5KB

MD5
528f383007234b421e3f1072fae5af11

SHA1
b19c49e17263d940ffa4d46c60a7cf2d03525f09

SHA256
531958a2b1de11d2da2eb8a5409f57c1f31253f79f790473d0efc0ae5567b61f

SHA512
d1813fc77b21ebcdada0cc9c410e533a39a436a038d91cb131bf03c987dab6e7e5b4c99f1a135adde84b4afcbd0a9f0f13931bae3c45c5782d7557fa620b4830

Download Submit
C:\Windows\28463\KQSW.exe

Filesize
513KB

MD5
1800b0b263035d94f7bb5e9e70270032

SHA1
c8ba77fa2e414ad11e39a6493e15c078c99d80e6

SHA256
0b15e820894e38d036e75abd442e1cebbfb734c4a50fd0f3adcd3b77211caa5e

SHA512
1431bedcba045f110354c7ec8a34ad5677447aa647581ebc86c25ee38397d2eff4b02d438227144b934ce65b26a2be65c44b761bd4b46518ff44ba6aaf06f29f

Download Submit
memory/1216-25-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/1216-29-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads