ardamax | be006790d460dccc454455f71e30b11e3f7924e902b3af72184c809bba127afd

Reason

Machine shutdown

General

Target

10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
Size

1.7MB
MD5

10946078079cbb0949a536067e2e3212
SHA1

01ad552b9bef788801a06c4c580f6ab11ccf3f7e
SHA256

be006790d460dccc454455f71e30b11e3f7924e902b3af72184c809bba127afd
SHA512

405ca02e377ad67477dc4975c0c09eb3413efc3a28ffbb296b38cc258590310c523850f7eea2d3c78b5cbfa491ce8a1b7c229de8f17d08362a3d3ce4b3b055a7
SSDEEP

49152:I2B/J6Dqk6DE2wirhnr2vwXDJRzLc7cgSjeMd+X:x/J6DR6DMWnSvwXDJF0cgSjH+

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023461-12.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
1036	WLTN.exe
2924	İnstall.exe.exe

Loads dropped DLL 7 IoCs

pid	Process
4488	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
1036	WLTN.exe
1036	WLTN.exe
1036	WLTN.exe
2924	İnstall.exe.exe
2924	İnstall.exe.exe
2924	İnstall.exe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WLTN Agent = "C:\\Windows\\SysWOW64\\28463\\WLTN.exe"	WLTN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\WLTN.001	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\WLTN.006	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\WLTN.007	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\WLTN.exe	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\key.bin	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\28463	WLTN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WLTN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	İnstall.exe.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\0\win32\	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\sdohlp.dll\\1"	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\Elevation\	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\InprocServer32\ = "%SystemRoot%\\SysWow64\\sppcomapi.dll"	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\FLAGS	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\0\win64	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\0\win64\ = "C:\\Windows\\SysWow64\\sdohlp.dll\\1"	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\TypeLib\	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\VersionIndependentProgID	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\ = "Monevi Ebavav class"	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\0\win32	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\ProgID\	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\FLAGS\ = "0"	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\ = "IAS SDO Helper 1.0 Type Library"	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\0	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\0\	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\Elevation	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\InprocServer32	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\InprocServer32\	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\ProgID\ = "SppComApi.SPPLUAObject.1"	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\FLAGS\	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\TypeLib	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\VersionIndependentProgID\	WLTN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\ProgID	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FC876651-96F3-502E-5A9C-E5689495D256}\1.0\0\win64\	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\TypeLib\ = "{FC876651-96F3-502E-5A9C-E5689495D256}"	WLTN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{61FD5CE4-865A-4E04-09B3-86588653492A}\VersionIndependentProgID\ = "SppComApi.SPPLUAObject"	WLTN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1036	WLTN.exe
Token: SeIncBasePriorityPrivilege	1036	WLTN.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1036	WLTN.exe
1036	WLTN.exe
1036	WLTN.exe
1036	WLTN.exe
1036	WLTN.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 1036	4488	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe	82
PID 4488 wrote to memory of 1036	4488	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe	82
PID 4488 wrote to memory of 1036	4488	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe	82
PID 4488 wrote to memory of 2924	4488	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe	83
PID 4488 wrote to memory of 2924	4488	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe	83
PID 4488 wrote to memory of 2924	4488	10946078079cbb0949a536067e2e3212_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\10946078079cbb0949a536067e2e3212_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10946078079cbb0949a536067e2e3212_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\28463\WLTN.exe
  "C:\Windows\system32\28463\WLTN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\İnstall.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\İnstall.exe.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@7C73.tmp

Filesize
4KB

MD5
70c6ae41897fd3fbc90821be9f6dcafd

SHA1
212294333e175cd4e647bd1738cf1e48de41fae2

SHA256
6e8e43f1ef95d0dce19434dbeb9576fdbafcfcd8ff2a1d0ada36516b1c11d634

SHA512
8822bc940cf1b64e2ec6b318a7f9702c056fcd45da025091609d9e1c455f6d00e2d9413433f827aad63c29212125d100027e43f4adcb235001b269ba0b6f54b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\İnstall.exe.exe

Filesize
1019KB

MD5
4cbf82281307f2dc3bfbf08a1685109f

SHA1
643ea8c47b7f5e14062e645d548752bfe066d97d

SHA256
92f93d8fbdb3ecf1b0564f67808198036ef1b0207068873a7d08e746e1835372

SHA512
bf9d41e5bc0871529d559b0a94bec76badb4e37678c4be718c9d9a373570bda7e7d4d748757940f30ba684991e30d8707acc16bf49dc7ff72cac785e7eb3754c

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
457KB

MD5
19794a23edc7494063603d316165c04f

SHA1
6b5050be2ffa32cc3dd0d1e53fa2cfe355c59b4e

SHA256
20aa8a967c2982acf1afce320284de9b4749fd3326b63c08fad8921720764b3e

SHA512
8f782e06cd32844a336548083eeb50d818ba8acbbba042719da7505dd2d239dc133eedcf244c19901bba7424d2eef60a977b6d6795de9baa6d56ad13c3828774

Download Submit
C:\Windows\SysWOW64\28463\WLTN.001

Filesize
410B

MD5
439731f2cee478a8cf481f0af6111455

SHA1
442a2e7e016d0255042f8b4ff0d571006e729b99

SHA256
d8194c972c15713fbf222d99110e2c61f3f6bb7719383f4cd0bcb1052a2acb14

SHA512
907948201364aa1ef2e66d2761fbf1c39a24dacb62a9fefb6981dfd57a13c34864734205a7e101a679675fdac3821f2ff8635aa4bc08aef607f2843c4fa134d2

Download Submit
C:\Windows\SysWOW64\28463\WLTN.006

Filesize
8KB

MD5
bc5fd352bfe50a09ffd84c95f697f9b4

SHA1
847a869a2b789c2f5c9845340f133b8845976aaa

SHA256
1c1bd72088d746302e15ed63f343bdbabae5ff39f1633e8f60ccd8e20dc0863f

SHA512
b52e8a1507b037ec2c5704c495bb53f3275a60ea35f02928117cb9dfe4718a78f77077571cd75bbe70c2b8f993251350db832834c509d1af9a20d00cedb5a197

Download Submit
C:\Windows\SysWOW64\28463\WLTN.007

Filesize
5KB

MD5
110bdf91b758328b3f33b4ab7d9fd480

SHA1
29d9ea9f08248307ef20c63cd1f02e8a5256d90b

SHA256
9cd15a69297174a062f839ee86f2f583f09952475891683a042f56d04bd581b3

SHA512
53efa1f722045a4f446e38bd780af1e5212de6052677596a7628eac2aa4a562c9752ae9859ee92530f5b3ac9ab2717777edbabdcb09f3f9ede2ba6063fe4bec7

Download Submit
C:\Windows\SysWOW64\28463\WLTN.exe

Filesize
648KB

MD5
ee07ce6e1da01ee9aa4a9cf523878dd7

SHA1
5d964e5919146fd2cd410909c03f3aab456cf062

SHA256
4ab1e4414b3659a21a5a39b0edd80e967e73140a809f6a8407e46df963ed8f7b

SHA512
487eade2e555e270536c1eeaf82ade3436cb8baef5476959a7de0b74df1082ce1b3917a66bc71965e1d4ba95e043706a543b29cfa485d65edc3102a98174e6b3

Download Submit
C:\Windows\SysWOW64\28463\key.bin

Filesize
106B

MD5
639d75ab6799987dff4f0cf79fa70c76

SHA1
be2678476d07f78bb81e8813c9ee2bfff7cc7efb

SHA256
fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

SHA512
4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

Download Submit
memory/1036-40-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/1036-52-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/1036-38-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/1036-37-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/1036-36-0x0000000003210000-0x0000000003213000-memory.dmp

Filesize
12KB

Download
memory/1036-35-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/1036-34-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/1036-33-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/1036-32-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/1036-31-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1036-30-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/1036-29-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/1036-50-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/1036-39-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/1036-51-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/1036-41-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/1036-42-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/1036-22-0x0000000000A20000-0x0000000000A7A000-memory.dmp

Filesize
360KB

Download
memory/1036-49-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/1036-19-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1036-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1036-58-0x0000000000A20000-0x0000000000A7A000-memory.dmp

Filesize
360KB

Download
memory/1036-61-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/2924-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2924-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads