ardamax | d2e763292ef4a13882824d3f509f8dd643ed9c9664f4ee08ebf5fb0885a9cece

General

Target

6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe
Size

256KB
MD5

6d35a9f9cdea71d2603caad084fde335
SHA1

ad36e19921b3e0b702578c2ce13dd59c0945e7e6
SHA256

d2e763292ef4a13882824d3f509f8dd643ed9c9664f4ee08ebf5fb0885a9cece
SHA512

558ff342f81f7929a7e380ddd5d0c7ee5423917578baa17d0b870c9e1b802afadd5c8c3195f27a1200920d366e1061f1b71f9178ecfcbb567cdd516ccf74b555
SSDEEP

6144:J9n5ssybeB1lbjN2t3/hd840jtkXMxoiRpWA9:JJ5/y8js590jFRIA9

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\MapleStory.exe	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

MapleStory.exeMapleGod.exe

pid process

232 MapleStory.exe
4388 MapleGod.exe
Loads dropped DLL 2 IoCs

Processes:

6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exeMapleGod.exe

pid process

2256 6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe
4388 MapleGod.exe

pid	process
232	MapleStory.exe
4388	MapleGod.exe

pid	process
2256	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe
4388	MapleGod.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MapleStory.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MapleStory = "C:\\Windows\\SysWOW64\\MapleStory.exe"	MapleStory.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe
Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
discovery

Network Service Discovery
T1046

Processes:

GameBarPresenceWriter.exe

pid process

4692 GameBarPresenceWriter.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

pid	process
4692	GameBarPresenceWriter.exe

Drops file in System32 directory 7 IoCs

Processes:

MapleGod.exeMapleStory.exe6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\H@tKeysH@@k.DLL	MapleGod.exe
File created	C:\Windows\SysWOW64\H@tKeysH@@k.DLL	MapleGod.exe
File opened for modification	C:\Windows\SysWOW64\MapleStory.001	MapleStory.exe
File created	C:\Windows\SysWOW64\MapleStory.001	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MapleStory.006	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MapleStory.007	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MapleStory.exe	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MapleGod.exe6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exeMapleStory.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MapleGod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MapleStory.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2437139445-1151884604-3026847218-1000\{3F46219D-18CE-4F75-90F8-1F2F65E1524D}	svchost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

MapleGod.exeOpenWith.exe

pid process

4388 MapleGod.exe
4388 MapleGod.exe
4388 MapleGod.exe
4388 MapleGod.exe
4388 MapleGod.exe
3244 OpenWith.exe

pid	process
4388	MapleGod.exe
4388	MapleGod.exe
4388	MapleGod.exe
4388	MapleGod.exe
4388	MapleGod.exe
3244	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe

description	pid	process	target process
PID 2256 wrote to memory of 232	2256	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe	MapleStory.exe
PID 2256 wrote to memory of 232	2256	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe	MapleStory.exe
PID 2256 wrote to memory of 232	2256	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe	MapleStory.exe
PID 2256 wrote to memory of 4388	2256	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe	MapleGod.exe
PID 2256 wrote to memory of 4388	2256	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe	MapleGod.exe
PID 2256 wrote to memory of 4388	2256	6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe	MapleGod.exe

C:\Users\Admin\AppData\Local\Temp\6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6d35a9f9cdea71d2603caad084fde335_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\MapleStory.exe
  "C:\Windows\system32\MapleStory.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:232
- C:\Users\Admin\AppData\Local\Temp\MapleGod.exe
  "C:\Users\Admin\AppData\Local\Temp\MapleGod.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4388

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4692

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@B788.tmp

Filesize
4KB

MD5
ccfd350414f3804bbb32ddd7eb3f6153

SHA1
e91d270b8481d456a3beabf617ef3379a93f1137

SHA256
1dabedfe9c7cda2d8aa74c95ba57fb832a4066b20f4051c0330b4422de237eb3

SHA512
328e069aaced9217eb9f4b4f20e27cd7ef933427e3388b3a0829089d694ea2280a2e5511a9eb577cec2a7b409cf367b0f17d8654076931648e152936fad810bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MapleGod.exe

Filesize
214KB

MD5
d678972d03482d3fdd303fc5e26f553c

SHA1
1acac0d490c8db091631d8fbeee772e1fff98445

SHA256
81384187117337a3823465cfdf5fe8f6646848f67e39aa84ef66f43ce44bdc4e

SHA512
da88146c0b5f83bc78505068c1d90663ab8dbfc80fee1f3af825b9299e11db472f526066428bb81e82e1298dd5bc7cbe5e6ef119bccccc1f128e80dcbb04dff2

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\SysWOW64\H@tKeysH@@k.DLL

Filesize
20KB

MD5
116ec20265b00cfe389518e2a0c7ed81

SHA1
d04c903ef681bb18dbf337ffa7ff2a9ccc8bedd6

SHA256
ef9d09e51c42bc04d48444b2517471ea07f2d8a6a6a2e67dd635b7bf95bf8b7a

SHA512
594f32c4e51a87294bcfa1735254d04d5d43a38ad2ab7a39f7157bac75b959ee327053df79ee2993a8a2f4e9faafb5c8868283ae2bac8745cb916d5565171cef

Download Submit
C:\Windows\SysWOW64\MapleStory.001

Filesize
1KB

MD5
b0cd952caee9751620794f6990f210e9

SHA1
302ee51d99574a05e91611d1db515e45cdd92453

SHA256
ee305863a36a508a2a2fef6102b96cde64b285369349a5395b28a689ab2a1a37

SHA512
6163e2b0cdc0549ea36d57c96390d064f138f93cfcf77f58b38e74f8632e490e41f8a0bf566b41d2e975ea94829863f58670c54eb13189cbae52c4656746d068

Download Submit
C:\Windows\SysWOW64\MapleStory.exe

Filesize
239KB

MD5
2bada91f44e2a5133a5c056b31866112

SHA1
9fbe664832d04d79f96fa090191b73d9811ef08d

SHA256
c742feab59b4e1b7b188b02ed91ab34eaeb83c87ac6babfb5f08649ed2b8cd02

SHA512
dc797a06061937f8dd657a34d4373d3069c9c1a6752752516042e5d135fc41257c7a3a6738b3accd626a02f1887476197eca0ab28cf568daf57269cbe9c8eb41

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads