ardamax | 74bb28da128af06c7d0e9ce0fcc6242fa31d807760f28f31742c19520dc379bc

General

Target

e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe
Size

506KB
MD5

e0103649f3bf097a9d4c22575b4225c3
SHA1

7a77a2fb6d6e1eb98743f3906ef4e8c989696659
SHA256

74bb28da128af06c7d0e9ce0fcc6242fa31d807760f28f31742c19520dc379bc
SHA512

cd89081b3b72c8861bd6519d47149c2d6fc42faf907ca37fa0fbb528334bf6d7907d7dffa953e91be25467c741d207efe8cf9ab037b00bafabe1e873dc190012
SSDEEP

12288:ohQtJ4pUKbi7eUjsrcuauQn6o/49z6BgF:oBNbi7xYZMzm

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234f1-21.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Install.exe

Executes dropped EXE 2 IoCs

pid	Process
2264	Install.exe
4904	LFLX.exe

Loads dropped DLL 7 IoCs

pid	Process
2264	Install.exe
4904	LFLX.exe
736	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe
4904	LFLX.exe
4904	LFLX.exe
736	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe
736	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LFLX Agent = "C:\\Windows\\SysWOW64\\28463\\LFLX.exe"	LFLX.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\criptografia.JPG	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\LFLX.001	Install.exe
File created	C:\Windows\SysWOW64\28463\LFLX.006	Install.exe
File created	C:\Windows\SysWOW64\28463\LFLX.007	Install.exe
File created	C:\Windows\SysWOW64\28463\LFLX.exe	Install.exe
File opened for modification	C:\Windows\SysWOW64\28463	LFLX.exe
File created	C:\Windows\SysWOW64\Install.exe	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LFLX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4904	LFLX.exe
Token: SeIncBasePriorityPrivilege	4904	LFLX.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4904	LFLX.exe
4904	LFLX.exe
4904	LFLX.exe
4904	LFLX.exe
4904	LFLX.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 2264	736	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe	83
PID 736 wrote to memory of 2264	736	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe	83
PID 736 wrote to memory of 2264	736	e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe	83
PID 2264 wrote to memory of 4904	2264	Install.exe	86
PID 2264 wrote to memory of 4904	2264	Install.exe	86
PID 2264 wrote to memory of 4904	2264	Install.exe	86

C:\Users\Admin\AppData\Local\Temp\e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e0103649f3bf097a9d4c22575b4225c3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\Install.exe
  "C:\Windows\system32\Install.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\28463\LFLX.exe
    "C:\Windows\system32\28463\LFLX.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@99EE.tmp

Filesize
4KB

MD5
908f7f4b0cf93759447afca95cd84aa6

SHA1
d1903a49b211bcb4a460904019ee7441420aa961

SHA256
3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

SHA512
958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

Download Submit
C:\Windows\SysWOW64\28463\LFLX.001

Filesize
468B

MD5
d0a5ec66eeeb63bb0d7134e29653f175

SHA1
eba044bb5307fcb14de4662f616b50c13fc2c6fd

SHA256
458fda318558b02a76538f4a0e157b80b6f18ebc435f3d2e1116a92d4276b82a

SHA512
a136719a89821a7338fd68aadac3469a6c7c26719e0d4b18983fd4e9ff08b84fc6c09facfda334f579d2c51698498f2cb71f2ab5084ac21f31dc9b8657e40185

Download Submit
C:\Windows\SysWOW64\28463\LFLX.006

Filesize
7KB

MD5
e0fcfa7cad88d1a8a462cee6b06cf668

SHA1
a7e49078517abc929a6da261df06556c8f5a8cf0

SHA256
340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

SHA512
430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

Download Submit
C:\Windows\SysWOW64\28463\LFLX.007

Filesize
5KB

MD5
ca72cd485d116033f1b776903ce7ee0a

SHA1
85b0b73a75b0498f56200dd1a5cf0de5371e42a3

SHA256
e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

SHA512
8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

Download Submit
C:\Windows\SysWOW64\28463\LFLX.exe

Filesize
472KB

MD5
9dcf9d92a95f82d3959f93f862ee0231

SHA1
d10b5a69594863cae4e5218e6ce80a203ac34028

SHA256
31573445d6b71ae2c4a185ac3f49270706fc4ff7aa0b13e564e42d983931cdb6

SHA512
c2c4149e62e0a83507510f0b9becc7bb24899333aa0f90666c84c1453d48fc5db670063c67dde839a0d607236d2f86166631cbc8dea4ced0b465f19630440443

Download Submit
C:\Windows\SysWOW64\Install.exe

Filesize
270KB

MD5
fe0412ebf1af3c6ace950cc15382098a

SHA1
525dab1230fbe2fcd113e7a56d139eb3d57b47b5

SHA256
2a4c496d89dbac19035550a56df6fffc210b7c60fa0f7a73a96cda23a87645ae

SHA512
fb07764819d23ce293b13571700b7cebf0b3122ab0921082a7f56c8b9d89efe2198de472d9f551aa5388a20329f31946d59b25d21c80287d499bc3897a8df2cd

Download Submit
memory/4904-30-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/4904-38-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads