ardamax | 6a8718b7edebd4a4d8782bf8e73ef4bcc98c65ad6f2de93e49777267021c3d7c

General

Target

1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Size

992KB
MD5

1f2455b3fabf0d58054a0465907214bc
SHA1

3b1cfe7b5a0aa99a6fd2ce013c696c6ad10da64e
SHA256

6a8718b7edebd4a4d8782bf8e73ef4bcc98c65ad6f2de93e49777267021c3d7c
SHA512

bd2fc5f36f761179c99ab0dbf3573fc7857557de7ec222f7714dbf87d2c5b67c660adf9dbc8318fded83f419a0ee67087143c58b87c8096fb94666e0725a815c
SSDEEP

24576:VDLo/S7kh4Vk2vr4velre8/AKqZGCImWB:VwS7ADKrUSrJ/AKL

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016dc8-33.dat	family_ardamax

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2828	Exporer32.exe
2740	YOCS.exe

Loads dropped DLL 7 IoCs

pid	Process
2392	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
2392	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
2828	Exporer32.exe
2828	Exporer32.exe
2828	Exporer32.exe
2740	YOCS.exe
2740	YOCS.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YOCS Agent = "C:\\Windows\\SysWOW64\\Sys32\\YOCS.exe"	YOCS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Sys32\YOCS.001	Exporer32.exe
File created	C:\Windows\SysWOW64\Sys32\YOCS.006	Exporer32.exe
File created	C:\Windows\SysWOW64\Sys32\YOCS.007	Exporer32.exe
File created	C:\Windows\SysWOW64\Sys32\YOCS.exe	Exporer32.exe
File created	C:\Windows\SysWOW64\Sys32\AKV.exe	Exporer32.exe
File opened for modification	C:\Windows\SysWOW64\Sys32	YOCS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exporer32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YOCS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ = "RecoveryTaskDispatchServer Class"	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ThreadingModel = "both"	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\VersionIndependentProgID	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\VersionIndependentProgID\ = "eHome.RecoveryTaskDispatchServer"	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ = "C:\\Windows\\eHome\\ehTrace.dll"	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID\ = "eHome.RecoveryTaskDispatchServer.1"	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	2392	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2392	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
Token: 33	2740	YOCS.exe
Token: SeIncBasePriorityPrivilege	2740	YOCS.exe
Token: SeIncBasePriorityPrivilege	2740	YOCS.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2392	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
2740	YOCS.exe
2740	YOCS.exe
2740	YOCS.exe
2740	YOCS.exe
2740	YOCS.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2828	2392	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe	31
PID 2392 wrote to memory of 2828	2392	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe	31
PID 2392 wrote to memory of 2828	2392	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe	31
PID 2392 wrote to memory of 2828	2392	1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe	31
PID 2828 wrote to memory of 2740	2828	Exporer32.exe	32
PID 2828 wrote to memory of 2740	2828	Exporer32.exe	32
PID 2828 wrote to memory of 2740	2828	Exporer32.exe	32
PID 2828 wrote to memory of 2740	2828	Exporer32.exe	32
PID 2740 wrote to memory of 2932	2740	YOCS.exe	33
PID 2740 wrote to memory of 2932	2740	YOCS.exe	33
PID 2740 wrote to memory of 2932	2740	YOCS.exe	33
PID 2740 wrote to memory of 2932	2740	YOCS.exe	33

C:\Users\Admin\AppData\Local\Temp\1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f2455b3fabf0d58054a0465907214bc_JaffaCakes118.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
  "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\Sys32\YOCS.exe
    "C:\Windows\system32\Sys32\YOCS.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\Sys32\YOCS.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Sys32\AKV.exe

Filesize
389KB

MD5
e591ff89b13f29aabb6eaa89ff564e73

SHA1
8ad1e64098bf5bee15c344b2dbbe5435b56b9476

SHA256
40d66939cd9287c96ee52b4a43d5a0a8a21e6021541c4ab0d488fc25a08d7ec5

SHA512
745c50560f41a0d51a55c5becc06a68d8d39c22123592d83c60782be61c68b7a31673068ee438036c4b7b0689da271d4683174325dfd96bfbddfcb694aa43864

Download Submit
C:\Windows\SysWOW64\Sys32\YOCS.001

Filesize
378B

MD5
3bd6151321af79ba49e62e89bbd4a800

SHA1
b5c553e7d0c3976af6856bfba67f843b5e3c4c2f

SHA256
0b6fcedfb11ce07647f44d22f5128074cccbcf2b14d1b8a009ad9e8c42410cb9

SHA512
2a6505bf5003c323eb4e60d11bf2ad616de7bd3fa5ee6356cb9a40946f98d977c7381c2a6705087ef492a47fa7c9a97ed638fec1a2e56ec7684038618a2b4b48

Download Submit
C:\Windows\SysWOW64\Sys32\YOCS.006

Filesize
7KB

MD5
d900395e1d7734f9a34463d887beb5f2

SHA1
29dfe275248cdff584a16df38bcd417f84b915c9

SHA256
24a43e754cc6456afdf1e5e66d996e2ced4832dd3ec5cff085b1865bf1387f2c

SHA512
881157a64b2d9909f96435a73da56c047aa36dc14b361593c7e6f0830b1b546101d74b2cc8a96bf234a6f199af0245bf2a45c7ba9ea09ae342850f8c048293c2

Download Submit
C:\Windows\SysWOW64\Sys32\YOCS.007

Filesize
5KB

MD5
aa9e3144dbe6ef2f3f382265de57b191

SHA1
442e593f7431c7ee97d01096386f59b5ae59ea16

SHA256
bb29e9c9ee351f68e3733b4997bf8a6150c0cab368ae701c3d157fadbc2254d8

SHA512
10ce8c9e008c4ca22215f8fb92c8b16a7200645f1893cab7429b524725cc85d1b03ee3d786bc22ae941629ee4c65f12329c8ef73457808cb5f0c9fed2c4e9ece

Download Submit
\Users\Admin\AppData\Local\Temp\@CAE.tmp

Filesize
3KB

MD5
f0c1e32bb02e06e0c842a4d873e3a229

SHA1
025e6413d0a5d415c98c8a2f7b2699f1f664abcd

SHA256
9b5d78196e41dd7eedc97a35c09efde8ee089d84215577717cfc9c7176ed2b56

SHA512
6ea657a07270a1b92dedcbebca14d03cbbde2faba5db12f48a4c643499a59f16bb7f89ef5eb483b47c8b98d74ab15e25b0b3e9e06fa955aaf48c88dc370b800e

Download Submit
\Users\Admin\AppData\Local\Temp\Exporer32.exe

Filesize
501KB

MD5
2e4b84b1c5a5d85bcd54ada9c75eaba5

SHA1
8a3eec97060e41c9883628aae78dcbde5802cef7

SHA256
30c1b7240a1bf4b68f7b58ab77df5bb45e94b97f46afec1e14b2b36dcb69326a

SHA512
faf9b4ef9c98b46038b6e57fb483efd11e375ff4bd1cb5d796a5ae8a8acda029368ecba5eb48803342be9df8abf849d4b2a7fa29ffe21fe64442ddcca3ff3375

Download Submit
\Windows\SysWOW64\Sys32\YOCS.exe

Filesize
475KB

MD5
d6e4d683a5013a173ce255ce3012428e

SHA1
bfa0c5bf47f296f9c90783854f2168760803fa57

SHA256
d3b4ea46bc6d5012041d18d026a33f26f9d4198d4dbe641ea33186143de9f52e

SHA512
a341aff2e8f3e7da566e9c7e897d0a824f10840932c3a6869e64d9696b4a058b1de88e6ab8b04c11c2336e27a4c3af29ac44612226ce149052346a743e3cf1b2

Download Submit
memory/2392-7-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/2392-32-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/2392-29-0x0000000000530000-0x000000000057D000-memory.dmp

Filesize
308KB

Download
memory/2392-5-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/2392-8-0x0000000000530000-0x000000000057D000-memory.dmp

Filesize
308KB

Download
memory/2392-6-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/2392-0-0x0000000000530000-0x000000000057D000-memory.dmp

Filesize
308KB

Download
memory/2740-48-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2740-51-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads