ardamax | fd0ec8df42aef561f8d7e4079881b5517090bc6080da6d51f9f647398d1a1dec

General

Target

e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe
Size

860KB
MD5

e82d9cc592aea529a0796e1055a3379f
SHA1

d27cdf1f201709aa52b88d1dd510b96a699e19a9
SHA256

fd0ec8df42aef561f8d7e4079881b5517090bc6080da6d51f9f647398d1a1dec
SHA512

9a2c73abf4baf6539e9d7c3bb70d8ebd2aefba86b77e01aaad2a14ced35c2465d776a6a5a9fbc398bc3f257986201e0281c607f2437265ef4b810287a2d88bc1
SSDEEP

24576:rZxT7e/P2C4uX8q0EoQtJW5BTdErO5Gwh6Utoas:rXTqn2juXD5LzEBxEoGw6

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0006000000019346-5.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
1700	HFC.exe
2512	MInstall.exe

Loads dropped DLL 10 IoCs

pid	Process
2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe
2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe
1700	HFC.exe
2512	MInstall.exe
2792	WerFault.exe
2792	WerFault.exe
2792	WerFault.exe
2792	WerFault.exe
2792	WerFault.exe
2792	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HFC Start = "C:\\Windows\\SysWOW64\\VHEMEM\\HFC.exe"	HFC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\VHEMEM\	HFC.exe
File created	C:\Windows\SysWOW64\VHEMEM\HFC.004	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VHEMEM\HFC.001	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VHEMEM\HFC.002	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\VHEMEM\HFC.exe	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	2512	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HFC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	1700	HFC.exe
Token: SeIncBasePriorityPrivilege	1700	HFC.exe
Token: SeDebugPrivilege	2512	MInstall.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1700	HFC.exe
1700	HFC.exe
1700	HFC.exe
1700	HFC.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1700	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	30
PID 2504 wrote to memory of 1700	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	30
PID 2504 wrote to memory of 1700	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	30
PID 2504 wrote to memory of 1700	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	30
PID 2504 wrote to memory of 2512	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	31
PID 2504 wrote to memory of 2512	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	31
PID 2504 wrote to memory of 2512	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	31
PID 2504 wrote to memory of 2512	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	31
PID 2504 wrote to memory of 2512	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	31
PID 2504 wrote to memory of 2512	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	31
PID 2504 wrote to memory of 2512	2504	e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2792	2512	MInstall.exe	32
PID 2512 wrote to memory of 2792	2512	MInstall.exe	32
PID 2512 wrote to memory of 2792	2512	MInstall.exe	32
PID 2512 wrote to memory of 2792	2512	MInstall.exe	32

C:\Users\Admin\AppData\Local\Temp\e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e82d9cc592aea529a0796e1055a3379f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\VHEMEM\HFC.exe
  "C:\Windows\system32\VHEMEM\HFC.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1700
- C:\Users\Admin\AppData\Local\Temp\MInstall.exe
  "C:\Users\Admin\AppData\Local\Temp\MInstall.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1148
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MInstall.exe

Filesize
22KB

MD5
abbf48086f8975dd9f5423247f6fb7cc

SHA1
8baa56a40450510dec788f3fafd4485b466e6a05

SHA256
e667a31e9a53605f18e2001c1a4050e7ad722514e2b2c64a9f06678af5f4d24a

SHA512
3ca83a03fc6256e7b2ff2211d001edacf01206d4977d65e50d95008ef08b117bf964e9b8894f0fc75b89c90e4941ad675057e8c7aaf06e7e194958b18d437f21

Download Submit
C:\Windows\SysWOW64\VHEMEM\HFC.002

Filesize
43KB

MD5
c04e0de732e8f56b401e409c4417149c

SHA1
7b260b3600345fb72af9fd0e4025b4a125c8dd08

SHA256
0d359c2c70001f56c14e7e29a12456c82606bb9a46f9db1f8216a9087775dec6

SHA512
d9e2bf02bcb144a8c37e05cb2544ca46fe93e1f2b5a4e08832d533ab9348ddb9153b5c36efa4186d625a80af5d546331d740a13f43c5195ccb4829c98eaa69b0

Download Submit
C:\Windows\SysWOW64\VHEMEM\HFC.004

Filesize
1KB

MD5
e941047b8555561a7c87257344f1561c

SHA1
c9a4eb528de1c711b2f13a4287e2dff4316effd4

SHA256
c25b50fa42e6ded661de049b9376e010b9689661e79314916f0abcbb7133ff66

SHA512
2505e86c7effa50efd7817dcf876623a5c236821d4669a15cd10e25e11c1847019d1192eaa5a7d972b202a369c823ac05717d9b6f2444725069c7291f9e17aae

Download Submit
\Windows\SysWOW64\VHEMEM\HFC.001

Filesize
61KB

MD5
5901282271c72b6effd11d0ec9c17547

SHA1
729945fc0534bd5203dbe02b2dcdf33d0edb84e1

SHA256
395e86709d918c7954ee97baaa34634ede86a2af233ac175c15ae3107f2e9a28

SHA512
05e92fad30ab5d89ebb6eb33fdc76ef9575dbf4c7d649782fd902010a11505a7499b38a4aceccf46e5f8b31617b730a0436cf821442b59dcdeec71ecc2a90a17

Download Submit
\Windows\SysWOW64\VHEMEM\HFC.exe

Filesize
1.5MB

MD5
82dc38922620ab6a5850f391584d2657

SHA1
ef30f091ff7aa242600f19e87f2b7b0cd7b0764f

SHA256
b464e42b8dfef6629030283e19c20bcc69d6d7c1bf9bb7e8df472f762debcea2

SHA512
4ec72c1d1599721ee1205f46a74a71fb67801e4d7aa6ca55907c2461a03c41cc3e1333e0b4ed9631b92e2310f45bf27cf865a5cc7ee2507e92f58cdb467023e8

Download Submit
memory/1700-20-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2512-22-0x00000000748FE000-0x00000000748FF000-memory.dmp

Filesize
4KB

Download
memory/2512-24-0x00000000013D0000-0x00000000013DC000-memory.dmp

Filesize
48KB

Download
memory/2512-31-0x00000000748FE000-0x00000000748FF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads