ardamax | 017cbe534aaa24c96e656bb9a668f3a8daf4d2f47eea6303a622ff3ce0c43f7a

General

Target

30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe
Size

1.8MB
MD5

30e959b92206bd6f77bae89864d46e2d
SHA1

2d4dbacd1568f4f499fdcf5ddd1ca82e1e035d33
SHA256

017cbe534aaa24c96e656bb9a668f3a8daf4d2f47eea6303a622ff3ce0c43f7a
SHA512

a0e3d9f32bfedf004191bf009300454efe5c0cc9b6ed8924a2f49c23904950d07eadbf594231ce3519b74141ce13d09337f588fe902288c47fc9f001dbe5327a
SSDEEP

49152:mMqGIllsRFysQnlw+OBb1g7RBFZRwK6ZUZcY4tb:xJNHQOBZeZaGZN4tb

Score

10^/10

ardamax discovery keylogger persistence stealer themida

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015d87-20.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2932	install.exe
2564	WCUN.exe

Loads dropped DLL 11 IoCs

pid	Process
2932	install.exe
2932	install.exe
2932	install.exe
2564	WCUN.exe
2564	WCUN.exe
2564	WCUN.exe
2564	WCUN.exe
2564	WCUN.exe
1252	DllHost.exe
1252	DllHost.exe
2932	install.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2448-9-0x0000000000400000-0x00000000006EA000-memory.dmp	themida
behavioral1/memory/2448-8-0x0000000000400000-0x00000000006EA000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WCUN Agent = "C:\\Windows\\SysWOW64\\28463\\WCUN.exe"	WCUN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\WCUN.006	install.exe
File created	C:\Windows\SysWOW64\28463\WCUN.007	install.exe
File created	C:\Windows\SysWOW64\28463\WCUN.exe	install.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	install.exe
File opened for modification	C:\Windows\SysWOW64\28463	WCUN.exe
File created	C:\Windows\SysWOW64\28463\WCUN.001	install.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\install.exe	30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2448	30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2564	WCUN.exe
Token: SeIncBasePriorityPrivilege	2564	WCUN.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1252	DllHost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2564	WCUN.exe
2564	WCUN.exe
2564	WCUN.exe
2564	WCUN.exe
2564	WCUN.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2932	2448	30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2932	2448	30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2932	2448	30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2932	2448	30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2932	2448	30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2932	2448	30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe	30
PID 2448 wrote to memory of 2932	2448	30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2564	2932	install.exe	31
PID 2932 wrote to memory of 2564	2932	install.exe	31
PID 2932 wrote to memory of 2564	2932	install.exe	31
PID 2932 wrote to memory of 2564	2932	install.exe	31
PID 2932 wrote to memory of 2564	2932	install.exe	31
PID 2932 wrote to memory of 2564	2932	install.exe	31
PID 2932 wrote to memory of 2564	2932	install.exe	31

C:\Users\Admin\AppData\Local\Temp\30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30e959b92206bd6f77bae89864d46e2d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\install.exe
  "C:\Windows\install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\28463\WCUN.exe
    "C:\Windows\system32\28463\WCUN.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2564

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jpeg.jpg

Filesize
16KB

MD5
ff58c7c17d26401f79e3c422192d09bc

SHA1
187d71eb3c4ec13361593ef06424298e9c8821b8

SHA256
0159d2f9377e4ddff64904fb5255708331eca02fc757a11a32d38a8d1e612dab

SHA512
566ba2c9bee4ef3b70b0235b32d62d1c7774b09e4e9e689bec72185b5fc55ad80ad6fad37d8ac119b5e3a45cece4941fec952d769dbbf81f3494597ad55b2b04

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
395KB

MD5
b8fa30233794772b8b76b4b1d91c7321

SHA1
0cf9561be2528944285e536f41d502be24c3aa87

SHA256
14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a

SHA512
10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d

Download Submit
C:\Windows\SysWOW64\28463\WCUN.001

Filesize
474B

MD5
3f0e1f697d6e2edde6ea1f77bb5e51e8

SHA1
de0084fe638aceeccafa12bb173ec8bd8552ba31

SHA256
484785c9b8cc5b17d437452a1436ae9869c70871e7e95646bb6dc990ba521b25

SHA512
f31a932bca0b3601453062fdeb28bee23f816fdf597ad3b799855d71d75e6e6fd9b45118ed164fd7bf6770c781790d977899b6ff0d58c1bbe36bf1f999cbd1c1

Download Submit
C:\Windows\SysWOW64\28463\WCUN.006

Filesize
8KB

MD5
43f02e9974b1477c1e6388882f233db0

SHA1
f3e27b231193f8d5b2e1b09d05ae3a62795cf339

SHA256
3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba

SHA512
e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

Download Submit
C:\Windows\SysWOW64\28463\WCUN.007

Filesize
5KB

MD5
b5a87d630436f958c6e1d82d15f98f96

SHA1
d3ff5e92198d4df0f98a918071aca53550bf1cff

SHA256
a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2

SHA512
fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

Download Submit
C:\Windows\install.exe

Filesize
496KB

MD5
0e4a61b106a2b1e2c1cc7a03501c404e

SHA1
81cf9d751e246c016d6c952fc34a9a921dd662ba

SHA256
bcae5dab837a8d245bd40167d1ae430f1f4bd444007bd4299e3acb374e59f980

SHA512
ff8f1be82af057ddae6c1d92d31910b5a7b702cd84b8a7e8cdf5de52cc06497de8c1a6bc65b2ee0a25bf838f71a08d21fb4a345f73ce0451e77b32fbd06f4efa

Download Submit
\Users\Admin\AppData\Local\Temp\@D88.tmp

Filesize
4KB

MD5
c3679c3ff636d1a6b8c65323540da371

SHA1
d184758721a426467b687bec2a4acc80fe44c6f8

SHA256
d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb

SHA512
494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

Download Submit
\Windows\SysWOW64\28463\WCUN.exe

Filesize
473KB

MD5
17535dddecf8cb1efdba1f1952126547

SHA1
a862a9a3eb6c201751be1038537522a5281ea6cb

SHA256
1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd

SHA512
b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

Download Submit
memory/1252-43-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2448-8-0x0000000000400000-0x00000000006EA000-memory.dmp

Filesize
2.9MB

Download
memory/2448-9-0x0000000000400000-0x00000000006EA000-memory.dmp

Filesize
2.9MB

Download
memory/2448-0-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2448-3-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2448-1-0x0000000000270000-0x0000000000350000-memory.dmp

Filesize
896KB

Download
memory/2932-42-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads