ardamax | baa98600745dc07ae41639a873f63c849dc0594ae66db9e212abfb5799b85ede

General

Target

28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
Size

1.2MB
MD5

28a5f2c51c56b0823b7af08f7d4ed0f1
SHA1

ba3d13e8035cd8f587029ca8f0fa1f21a1ce5183
SHA256

baa98600745dc07ae41639a873f63c849dc0594ae66db9e212abfb5799b85ede
SHA512

67f15b634cc1c8f95a3ded29a24124ee3e6a771e25a4192831be936d53c26b056f83cd49fcf12417209a7bcfac2b202ffd699c61ddeab926223010d09cd61371
SSDEEP

24576:iITTqxWJhhL6GjT46OxDcTTETBiXbj06blqb7D49Dktpla:i6TqxWJLGGI6OxDYSYQ6pEkQ

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0006000000018683-6.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2272	IQN.exe

Loads dropped DLL 4 IoCs

pid	Process
2600	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
2272	IQN.exe
1912	DllHost.exe
2600	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IQN Start = "C:\\Windows\\SysWOW64\\HYNHNF\\IQN.exe"	IQN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HYNHNF\IQN.exe	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\HYNHNF\	IQN.exe
File created	C:\Windows\SysWOW64\HYNHNF\IQN.008	IQN.exe
File opened for modification	C:\Windows\SysWOW64\HYNHNF\IQN.008	IQN.exe
File created	C:\Windows\SysWOW64\HYNHNF\IQN.004	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HYNHNF\IQN.001	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HYNHNF\IQN.002	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HYNHNF\AKV.exe	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IQN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2272	IQN.exe
2272	IQN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2272	IQN.exe
Token: SeIncBasePriorityPrivilege	2272	IQN.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	DllHost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	IQN.exe
2272	IQN.exe
2272	IQN.exe
2272	IQN.exe
1912	DllHost.exe
1912	DllHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2272	2600	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2272	2600	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2272	2600	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2272	2600	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\HYNHNF\IQN.exe
  "C:\Windows\system32\HYNHNF\IQN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2272

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9.jpg

Filesize
34KB

MD5
302d8e4e0518ac83293a79cf7545e4c3

SHA1
82d2a5f68dd4094c9827902e860e468ed77cf244

SHA256
32647128bcb989bace758fc5a812b2fe46b429e04ca5e4cbef647f1e218c1f1f

SHA512
f38da534421730e8873c7090531a1e90f9e46fe7e0030bda45df07669bfc0cb21131a3f17bec973070995d74dd74c100a1c73c8321d89f2b044aa5ab2deeb947

Download Submit
C:\Windows\SysWOW64\HYNHNF\AKV.exe

Filesize
490KB

MD5
21f362e0d289ba822e526fced424c1f2

SHA1
21118c5c57264eb48a0fde577ec06d4cb07a404c

SHA256
7c561dea779006b50d5befeef48a965dbef1c3b807983bb6411adf27a8c87779

SHA512
349459969f00fc06e5cc9479d1e0860b371170ac787bcab03c46e27d3bec7f909d22c8ee76d3e6f75e43a8f73a074a8cf3021a87a86fedcc7af611ea41346399

Download Submit
C:\Windows\SysWOW64\HYNHNF\IQN.001

Filesize
61KB

MD5
93c2eac6b4d476a04730266ec1523f8a

SHA1
d53544650a95769d90c89fa90039399cb8d7e054

SHA256
898d4ed4dc6b52db670bf57bd859ae6e1c25230b28a69e7d0e548bae6941cba8

SHA512
9dc516552c08af9600ebabb025bfed1b9a8f16aafbf1cb7530af7254847264399a118a3bbf980e54ad01542fb4c0df55699d207ac44d85bd0eb94067b1a0bae0

Download Submit
C:\Windows\SysWOW64\HYNHNF\IQN.002

Filesize
44KB

MD5
92fc2d978e3dcc66dbbe6ddde516dd75

SHA1
2e31d1a209193872fc7f494274b17f582bb137c0

SHA256
a89bebf2e88c1055b1d38bb715a7efeef93c18d5ec1d32a171ae354ccba4087c

SHA512
50d859f3abaf2d2bcf563a0bf0f47b3be0d1ea0f345fc69f5c9a3635d359798c068e4516803c7b8bd0a61b01b3bb1ece0a4703a278144acfa877311317a959ba

Download Submit
C:\Windows\SysWOW64\HYNHNF\IQN.004

Filesize
1KB

MD5
ee58cfa0c48494ed6ddf561b720b91ce

SHA1
73862c6327c13b87a655e71ac791f64989f24d88

SHA256
2509baafbcd6863c7583882b83a54f354b7c91e2e43f63b5890f170def49ea4a

SHA512
cad365f8f907a4a4faf1102138b5bc7682a732bb184e160b3bd20ca1ee45e82371321d7e1b94c4bc5b47948b71245c0cef5e02313065a0c33c10d2554609bc87

Download Submit
C:\Windows\SysWOW64\HYNHNF\IQN.008

Filesize
458B

MD5
48d969f73dcc1fe421d657c7f1fb2bd1

SHA1
5e3e286beb10d334b855b9175ea1bd445f49e068

SHA256
0bb0ce2b3454f400d82000e95884d1214b9fc96f7e82d27817c2c09636415af8

SHA512
6170fce06ee68d9216bfc79983d955ea12806305052c8aa95845807628ad39062791e62330a85f5879eaa275b7354ae577038d34a26e2a58aea8da43bee88627

Download Submit
\Windows\SysWOW64\HYNHNF\IQN.exe

Filesize
1.7MB

MD5
851f20b20b52b01ee3e1000c89b47c93

SHA1
f46b94a834d6ba980b096747d725bd975d5d0dbc

SHA256
10b92386e4d23ae4fecbe8f5114bf494cf6012d379a1dd694b5130d5900e7651

SHA512
0eedbd7be28f504c87308552c780b9597d19b9cf220e3995f0d6f351ce21cf2a16f9969d4ed22170151373b5e0c8b9fa62b5b3feb7ecf335606d5d0e7ca6761e

Download Submit
memory/1912-25-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2272-16-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2272-30-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2600-24-0x0000000000A60000-0x0000000000A62000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads