ardamax | baa98600745dc07ae41639a873f63c849dc0594ae66db9e212abfb5799b85ede

General

Target

28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
Size

1.2MB
MD5

28a5f2c51c56b0823b7af08f7d4ed0f1
SHA1

ba3d13e8035cd8f587029ca8f0fa1f21a1ce5183
SHA256

baa98600745dc07ae41639a873f63c849dc0594ae66db9e212abfb5799b85ede
SHA512

67f15b634cc1c8f95a3ded29a24124ee3e6a771e25a4192831be936d53c26b056f83cd49fcf12417209a7bcfac2b202ffd699c61ddeab926223010d09cd61371
SSDEEP

24576:iITTqxWJhhL6GjT46OxDcTTETBiXbj06blqb7D49Dktpla:i6TqxWJLGGI6OxDYSYQ6pEkQ

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b9c-8.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3628	IQN.exe

Loads dropped DLL 2 IoCs

pid	Process
3628	IQN.exe
3544	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IQN Start = "C:\\Windows\\SysWOW64\\HYNHNF\\IQN.exe"	IQN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HYNHNF\IQN.008	IQN.exe
File opened for modification	C:\Windows\SysWOW64\HYNHNF\IQN.008	IQN.exe
File created	C:\Windows\SysWOW64\HYNHNF\IQN.004	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HYNHNF\IQN.001	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HYNHNF\IQN.002	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HYNHNF\AKV.exe	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HYNHNF\IQN.exe	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\HYNHNF\	IQN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IQN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3628	IQN.exe
3628	IQN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3628	IQN.exe
Token: SeIncBasePriorityPrivilege	3628	IQN.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3628	IQN.exe
3628	IQN.exe
3628	IQN.exe
3628	IQN.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3628	3544	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe	87
PID 3544 wrote to memory of 3628	3544	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe	87
PID 3544 wrote to memory of 3628	3544	28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\HYNHNF\IQN.exe
  "C:\Windows\system32\HYNHNF\IQN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\HYNHNF\AKV.exe

Filesize
490KB

MD5
21f362e0d289ba822e526fced424c1f2

SHA1
21118c5c57264eb48a0fde577ec06d4cb07a404c

SHA256
7c561dea779006b50d5befeef48a965dbef1c3b807983bb6411adf27a8c87779

SHA512
349459969f00fc06e5cc9479d1e0860b371170ac787bcab03c46e27d3bec7f909d22c8ee76d3e6f75e43a8f73a074a8cf3021a87a86fedcc7af611ea41346399

Download Submit
C:\Windows\SysWOW64\HYNHNF\IQN.001

Filesize
61KB

MD5
93c2eac6b4d476a04730266ec1523f8a

SHA1
d53544650a95769d90c89fa90039399cb8d7e054

SHA256
898d4ed4dc6b52db670bf57bd859ae6e1c25230b28a69e7d0e548bae6941cba8

SHA512
9dc516552c08af9600ebabb025bfed1b9a8f16aafbf1cb7530af7254847264399a118a3bbf980e54ad01542fb4c0df55699d207ac44d85bd0eb94067b1a0bae0

Download Submit
C:\Windows\SysWOW64\HYNHNF\IQN.002

Filesize
44KB

MD5
92fc2d978e3dcc66dbbe6ddde516dd75

SHA1
2e31d1a209193872fc7f494274b17f582bb137c0

SHA256
a89bebf2e88c1055b1d38bb715a7efeef93c18d5ec1d32a171ae354ccba4087c

SHA512
50d859f3abaf2d2bcf563a0bf0f47b3be0d1ea0f345fc69f5c9a3635d359798c068e4516803c7b8bd0a61b01b3bb1ece0a4703a278144acfa877311317a959ba

Download Submit
C:\Windows\SysWOW64\HYNHNF\IQN.004

Filesize
1KB

MD5
ee58cfa0c48494ed6ddf561b720b91ce

SHA1
73862c6327c13b87a655e71ac791f64989f24d88

SHA256
2509baafbcd6863c7583882b83a54f354b7c91e2e43f63b5890f170def49ea4a

SHA512
cad365f8f907a4a4faf1102138b5bc7682a732bb184e160b3bd20ca1ee45e82371321d7e1b94c4bc5b47948b71245c0cef5e02313065a0c33c10d2554609bc87

Download Submit
C:\Windows\SysWOW64\HYNHNF\IQN.008

Filesize
327B

MD5
c99423725ac836225ca0a55837d9f9fd

SHA1
3afdd851928897fb0eb845f89bb2253b5ed8d609

SHA256
bf51b70e30987ab1cbd4da81901c4392bf74b1b0ab4e81480d14a91b37b8c497

SHA512
24e4ca3b659c2c9a4d12cee06946be13908c939bf9c66f1fb442fd2c439d0e557c689654fd818d013538c5b721fb5a307a4449533bcfaef5daf1ce0e2e26e3ec

Download Submit
C:\Windows\SysWOW64\HYNHNF\IQN.exe

Filesize
1.7MB

MD5
851f20b20b52b01ee3e1000c89b47c93

SHA1
f46b94a834d6ba980b096747d725bd975d5d0dbc

SHA256
10b92386e4d23ae4fecbe8f5114bf494cf6012d379a1dd694b5130d5900e7651

SHA512
0eedbd7be28f504c87308552c780b9597d19b9cf220e3995f0d6f351ce21cf2a16f9969d4ed22170151373b5e0c8b9fa62b5b3feb7ecf335606d5d0e7ca6761e

Download Submit
memory/3628-17-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/3628-24-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads