ardamax | 71965284079b0a4a097d904186419979e140887f4b1582a0631fab635d688b64

General

Target

1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe
Size

2.2MB
MD5

1b86fc360babff48dd67e19f6b69803f
SHA1

be996e5618c3d6a0efeedf391bea672ccf5a0058
SHA256

71965284079b0a4a097d904186419979e140887f4b1582a0631fab635d688b64
SHA512

1b0e15e90d029613dbccd057b9b75b8fa03227fb7a89fc889f94d46516702939880c355d54e7e4e6974a8921fbd684b97f7aeaf6d8cc6549d0c67a38ebcca689
SSDEEP

49152:cFXTXA/0pYjmvpXCorG55o6bDU0mIXTXA/0pYjmvpXCorG55o6bDU0mj:z/0pOmvR+Z/U1b/0pOmvR+Z/U1j

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002346d-27.dat	family_ardamax

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe

Executes dropped EXE 4 IoCs

pid	Process
2184	Install.exe
4308	Install.exe
3196	MLH.exe
3856	MLH.exe

Loads dropped DLL 1 IoCs

pid	Process
3196	MLH.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MLH Start = "C:\\Windows\\SysWOW64\\URYLDI\\MLH.exe"	MLH.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\URYLDI\MLH.001	Install.exe
File created	C:\Windows\SysWOW64\URYLDI\MLH.002	Install.exe
File created	C:\Windows\SysWOW64\URYLDI\AKV.exe	Install.exe
File opened for modification	C:\Windows\SysWOW64\URYLDI\	MLH.exe
File created	C:\Windows\SysWOW64\URYLDI\MLH.002	Install.exe
File created	C:\Windows\SysWOW64\URYLDI\MLH.exe	Install.exe
File created	C:\Windows\SysWOW64\URYLDI\MLH.004	Install.exe
File created	C:\Windows\SysWOW64\URYLDI\MLH.exe	Install.exe
File created	C:\Windows\SysWOW64\URYLDI\MLH.004	Install.exe
File created	C:\Windows\SysWOW64\URYLDI\MLH.001	Install.exe
File created	C:\Windows\SysWOW64\URYLDI\AKV.exe	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MLH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MLH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3196	MLH.exe
Token: SeIncBasePriorityPrivilege	3196	MLH.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3196	MLH.exe
3196	MLH.exe
3196	MLH.exe
3196	MLH.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2184	1832	1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe	82
PID 1832 wrote to memory of 2184	1832	1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe	82
PID 1832 wrote to memory of 2184	1832	1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe	82
PID 1832 wrote to memory of 4308	1832	1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe	83
PID 1832 wrote to memory of 4308	1832	1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe	83
PID 1832 wrote to memory of 4308	1832	1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe	83
PID 4308 wrote to memory of 3196	4308	Install.exe	84
PID 4308 wrote to memory of 3196	4308	Install.exe	84
PID 4308 wrote to memory of 3196	4308	Install.exe	84
PID 2184 wrote to memory of 3856	2184	Install.exe	85
PID 2184 wrote to memory of 3856	2184	Install.exe	85
PID 2184 wrote to memory of 3856	2184	Install.exe	85

C:\Users\Admin\AppData\Local\Temp\1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b86fc360babff48dd67e19f6b69803f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\URYLDI\MLH.exe
    "C:\Windows\system32\URYLDI\MLH.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3856
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\URYLDI\MLH.exe
    "C:\Windows\system32\URYLDI\MLH.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Install.exe

Filesize
1.1MB

MD5
b029691c6c29c938bb8a9ab06045c72e

SHA1
c85635f551768f7e640ca712109f67fdacc57774

SHA256
d34399b7636c50fd00bdeddefd9b27fcfd0162004fa980387e518546b8a9ece0

SHA512
c8e3ae043b8c8e4bc1248ecd82eb81b597658f3e5b8e1564010c520fc7a9d9cebb212a271b0259e3d68081da47250124840329cc8f5f7170943c836d583ca259

Download Submit
C:\Windows\SysWOW64\URYLDI\AKV.exe

Filesize
456KB

MD5
1f29b1075a91b3da0ccc0b9c49eece56

SHA1
048e675f087181035aedece9e7b11d065c6355cc

SHA256
4f6825548b32329c3360ed9abb7c0a6809a2c2291cf0bcaac511a9fa32a6336e

SHA512
7e152caf055f57f599ecc1e3a404b540b721b3315d2ba16bff6eb21f03edeb3a06ae185621e3139293612d94210f500f098bd281489ca7f336efd8b5284ee060

Download Submit
C:\Windows\SysWOW64\URYLDI\MLH.001

Filesize
61KB

MD5
31c866d8e4448c28ae63660a0521cd92

SHA1
0e4dcb44e3c8589688b8eacdd8cc463a920baab9

SHA256
dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1

SHA512
1076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839

Download Submit
C:\Windows\SysWOW64\URYLDI\MLH.002

Filesize
43KB

MD5
093e599a1281e943ce1592f61d9591af

SHA1
6896810fe9b7efe4f5ae68bf280fec637e97adf5

SHA256
1ac0964d97b02204f4d4ae79cd5244342f1a1798f5846e9dd7f3448d4177a009

SHA512
64cb58fbf6295d15d9ee6a8a7a325e7673af7ee02e4ece8da5a95257f666566a425b348b802b78ac82e7868ba7923f85255c2c31e548618afa9706c1f88d34dc

Download Submit
C:\Windows\SysWOW64\URYLDI\MLH.004

Filesize
1KB

MD5
f9b9b135e765963125e1e43bd2ed17dd

SHA1
897c92d91cb1b69021e120038e7e0d1155fa057c

SHA256
e6f0079f0313493ccba7d375925b7c640a8011fa675a922232e17ff0d0ecff3c

SHA512
7677950c9b5907490f7a5b573de8ee5d1942e61821517d16c7c917789e5378b41e14f3b77fba985e41bd33505ea1bf350eb35ff07c252c0db8e98c5ecdf529ce

Download Submit
C:\Windows\SysWOW64\URYLDI\MLH.exe

Filesize
1.5MB

MD5
0aaffc12ef1b416b9276bdc3fdec9dff

SHA1
9f38d7cf6241d867da58f89db9ff26544314b938

SHA256
42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b

SHA512
bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c

Download Submit
memory/1832-0-0x0000000075542000-0x0000000075543000-memory.dmp

Filesize
4KB

Download
memory/1832-1-0x0000000075540000-0x0000000075AF1000-memory.dmp

Filesize
5.7MB

Download
memory/1832-2-0x0000000075540000-0x0000000075AF1000-memory.dmp

Filesize
5.7MB

Download
memory/1832-30-0x0000000075540000-0x0000000075AF1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads