ardamax | 238b0e5bd34df4a6cda3232a5e65da5d2b6291a3ad4838b417043aee2eda1cc8

General

Target

fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe
Size

1.8MB
MD5

fd117e9054e30aa6722b9207518e5e67
SHA1

4c8cb147acaa046ffce44e3eb5bae2054594f960
SHA256

238b0e5bd34df4a6cda3232a5e65da5d2b6291a3ad4838b417043aee2eda1cc8
SHA512

1498287e56bba5320f396060d343cc1da59b598498041d77db0d36768e00f265f805c9fc4a60a58affbfc9aa80489757ce56246b9deb8c92de671a537c3c08df
SSDEEP

49152:J8rMjkA/nHBMz6V8XEa9R9vMjmm0BiPkWps3KxOZEW/o6s:iQjkuS6aXQOBiIsOaW/o6s

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer themida

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016d4e-23.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2872	cheatmoney.exe
2988	HUGK.exe

Loads dropped DLL 5 IoCs

pid	Process
2872	cheatmoney.exe
2872	cheatmoney.exe
2872	cheatmoney.exe
2988	HUGK.exe
2988	HUGK.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2668-5-0x0000000000400000-0x00000000006F7000-memory.dmp	themida
behavioral1/memory/2668-17-0x0000000000400000-0x00000000006F7000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HUGK Agent = "C:\\Windows\\SysWOW64\\28463\\HUGK.exe"	HUGK.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\HUGK.exe	cheatmoney.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	cheatmoney.exe
File opened for modification	C:\Windows\SysWOW64\28463	HUGK.exe
File created	C:\Windows\SysWOW64\28463\HUGK.001	cheatmoney.exe
File created	C:\Windows\SysWOW64\28463\HUGK.006	cheatmoney.exe
File created	C:\Windows\SysWOW64\28463\HUGK.007	cheatmoney.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\cheatmoney.exe	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HUGK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cheatmoney.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2668	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2988	HUGK.exe
Token: SeIncBasePriorityPrivilege	2988	HUGK.exe
Token: SeIncBasePriorityPrivilege	2988	HUGK.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2988	HUGK.exe
2988	HUGK.exe
2988	HUGK.exe
2988	HUGK.exe
2988	HUGK.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2872	2668	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2872	2668	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2872	2668	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2872	2668	fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe	31
PID 2872 wrote to memory of 2988	2872	cheatmoney.exe	32
PID 2872 wrote to memory of 2988	2872	cheatmoney.exe	32
PID 2872 wrote to memory of 2988	2872	cheatmoney.exe	32
PID 2872 wrote to memory of 2988	2872	cheatmoney.exe	32
PID 2988 wrote to memory of 2188	2988	HUGK.exe	33
PID 2988 wrote to memory of 2188	2988	HUGK.exe	33
PID 2988 wrote to memory of 2188	2988	HUGK.exe	33
PID 2988 wrote to memory of 2188	2988	HUGK.exe	33

C:\Users\Admin\AppData\Local\Temp\fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd117e9054e30aa6722b9207518e5e67_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\cheatmoney.exe
  "C:\Windows\cheatmoney.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\28463\HUGK.exe
    "C:\Windows\system32\28463\HUGK.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\HUGK.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\AKV.exe

Filesize
405KB

MD5
dc82dc0d160dbcb878f36801464f7caa

SHA1
ab2f476da88d018b7aa27f8bdd9f15405b49169a

SHA256
a79c4e0c6490d7319ab85d4d4a2bbf9e0c84a8e5af86b52c9ddb8779ffabb8fd

SHA512
e3a8c85871026fdb15261da096aaac73236ceb5e6b60f091fa027565dc6f39ed4b9c27bb4b09d48aed6c5d849464e2e8540e1823e07d9bfbd77422d83125beed

Download Submit
C:\Windows\SysWOW64\28463\HUGK.001

Filesize
536B

MD5
deb0dfed8f9206d25b7baa5df5e0c474

SHA1
1b9d0e5624359ebbf55df54131d1add5d8dbb5de

SHA256
02fc44353f2c19dfdf916360ec79d97379e1599ad8f941769cd12d0dcbb70fa6

SHA512
591a67b429928efe65619bcab4121249f01b290fcacc6c0a3ca24cfce9e51ac2ee9e805855be85035f6276aecbd6aab0a287f688374c647f22c0b0ef05c8119e

Download Submit
C:\Windows\SysWOW64\28463\HUGK.007

Filesize
5KB

MD5
2166b0dbd65cc3244d0a2e7695b32a40

SHA1
358e6bbd414ce534c6bf60785281928ca8abcc23

SHA256
6c97872edcb4f6af14d0650f6b9f7256d0081b1d7ff77050e56fbe1d894044d2

SHA512
45e51c7cd899eaa7187d7adee6bf89cf52b4c48908e72499afdfeaf5db5846614a9bfe60773abd551a8e89f718ad5d875cdff3f25f5a80ca219d49418157d6eb

Download Submit
C:\Windows\cheatmoney.exe

Filesize
493KB

MD5
114256b1982384988173a2a222e02abc

SHA1
1ed832c6e06ff35aec5d66b995e1ba302b8fc5ab

SHA256
29c9ab65ec1725982dd8a3a95e87cd5d83d92b62fe9365204899350550bbcd76

SHA512
6179044339e4be898ab9b35c088b828ddc070e5c8b223be7a334d4e4a05e472fe7f93084e85c4612b0896e49117333795fc73d97248c157606f153e0022c7e54

Download Submit
\Users\Admin\AppData\Local\Temp\@F612.tmp

Filesize
4KB

MD5
d9cb831b02f14f8371acd33c684190fb

SHA1
5035c9ceaf35bf0c14cdc0349d1284beb0e3892b

SHA256
be821327fbd0d0a4b0e61f939349cfaa660a3cbcf037dd8c664a1a52372b32a5

SHA512
452d409cfd53dc8a98e7e9746d7c88e0545df024f1fe5ab81a1ecab84664b8ca7eb8d53d1c66322d49dfe74035d5e6540ad7c95b57757fe91af99bb8edab097e

Download Submit
\Windows\SysWOW64\28463\HUGK.006

Filesize
8KB

MD5
d06046faed6ce5b6c70786ca53cd79a6

SHA1
18a945748b4aa894487530612e6aaf20c4a5d074

SHA256
fc01b2bcc8f17f707502d7fd5a14217863a1e3e00a8529c2a9e8d46f39ee1412

SHA512
96769913e2a30ccc21deaa7803013d44ae437edee2bf9fc0532055da3c4a6c5de0bb6485da46dca00caab35a43014361713d5282e0783065f9ce5a7523012e90

Download Submit
\Windows\SysWOW64\28463\HUGK.exe

Filesize
500KB

MD5
a4c7f5f230b30d5e289a092bd915952c

SHA1
db42fb8d2fdf74ddbe6789a4e4a725b41e8612cf

SHA256
531a5334e3132b0df427514b614075800d0cf0f4ada9da4c8a60632b53f3fd5d

SHA512
601475753cf9159670c544d53fbbe31fc7063cb95c905c3e1d5a9bc296482e29ff0abc3e5058f724d622c4aeaf3a35ebff75752828bd7176aae291a51713d56e

Download Submit
memory/2668-17-0x0000000000400000-0x00000000006F7000-memory.dmp

Filesize
3.0MB

Download
memory/2668-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2668-5-0x0000000000400000-0x00000000006F7000-memory.dmp

Filesize
3.0MB

Download
memory/2668-3-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/2668-1-0x0000000002000000-0x00000000020E7000-memory.dmp

Filesize
924KB

Download
memory/2988-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2988-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2988-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads