ardamax | dcbc1479ff0f0dc4eeb8ced0237c18042f0b0396fe4c4de74336ed1e9fa2c3a2

General

Target

6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe
Size

806KB
MD5

6f7708a440a47ce2491ae97e6f85bfcc
SHA1

6817471fa80703f6e87f0cdf5a977730966ebb52
SHA256

dcbc1479ff0f0dc4eeb8ced0237c18042f0b0396fe4c4de74336ed1e9fa2c3a2
SHA512

44e0ecff21522394103964542a3f217d65ca814ee8da104d96f42cdd3a3f9525c40f2c37026809825eef4b43380e0fba6b3971d0bffb6c19d1990925d3d842ee
SSDEEP

12288:5xAveq3DxzlsUjbnoUi+zpKWGbOwj0Slh+mViKTitwR18XDTpySdT:/9AJWAbdJLGbOwjUKTyDsSdT

Score

10^/10

ardamax discovery keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00050000000197aa-43.dat	family_ardamax

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	26229.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	26229.exe

Executes dropped EXE 4 IoCs

pid	Process
2748	26229.exe
2824	Exporer32.exe
2612	msnmgs.exe
2184	MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe

Loads dropped DLL 11 IoCs

pid	Process
2748	26229.exe
2748	26229.exe
2824	Exporer32.exe
2824	Exporer32.exe
2824	Exporer32.exe
2824	Exporer32.exe
2184	MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe
2184	MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe
2184	MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe
2612	msnmgs.exe
2612	msnmgs.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Sys\msnmgs.exe	Exporer32.exe
File opened for modification	C:\Windows\SysWOW64\Sys	msnmgs.exe
File created	C:\Windows\SysWOW64\Sys\msnmgs.009	msnmgs.exe
File opened for modification	C:\Windows\SysWOW64\Sys\msnmgs.009	msnmgs.exe
File created	C:\Windows\SysWOW64\Sys\msnmgs.001	Exporer32.exe
File created	C:\Windows\SysWOW64\Sys\msnmgs.006	Exporer32.exe
File created	C:\Windows\SysWOW64\Sys\msnmgs.007	Exporer32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\26229.exe	6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe
File opened for modification	C:\Windows\26229.exe	26229.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msnmgs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exporer32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ = "%SystemRoot%\\SysWow64\\NaturalLanguage6.dll"	26229.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ThreadingModel = "Both"	26229.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}	26229.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32	26229.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2748	26229.exe
Token: SeIncBasePriorityPrivilege	2748	26229.exe
Token: 33	2612	msnmgs.exe
Token: SeIncBasePriorityPrivilege	2612	msnmgs.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2748	26229.exe
2612	msnmgs.exe
2612	msnmgs.exe
2612	msnmgs.exe
2612	msnmgs.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2748	2656	6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2748	2656	6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2748	2656	6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2748	2656	6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2824	2748	26229.exe	31
PID 2748 wrote to memory of 2824	2748	26229.exe	31
PID 2748 wrote to memory of 2824	2748	26229.exe	31
PID 2748 wrote to memory of 2824	2748	26229.exe	31
PID 2824 wrote to memory of 2612	2824	Exporer32.exe	32
PID 2824 wrote to memory of 2612	2824	Exporer32.exe	32
PID 2824 wrote to memory of 2612	2824	Exporer32.exe	32
PID 2824 wrote to memory of 2612	2824	Exporer32.exe	32
PID 2824 wrote to memory of 2184	2824	Exporer32.exe	33
PID 2824 wrote to memory of 2184	2824	Exporer32.exe	33
PID 2824 wrote to memory of 2184	2824	Exporer32.exe	33
PID 2824 wrote to memory of 2184	2824	Exporer32.exe	33
PID 2824 wrote to memory of 2184	2824	Exporer32.exe	33
PID 2824 wrote to memory of 2184	2824	Exporer32.exe	33
PID 2824 wrote to memory of 2184	2824	Exporer32.exe	33

C:\Users\Admin\AppData\Local\Temp\6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\26229.exe
  C:\Windows\26229.exe
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
    "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\Sys\msnmgs.exe
      "C:\Windows\system32\Sys\msnmgs.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe
      "C:\Users\Admin\AppData\Local\Temp\MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\26229.exe

Filesize
772KB

MD5
011b0fcb7ad7dc56778f6da8fd737f57

SHA1
bc8d23305cf89407b4871ca4a7f33e59a70d74d6

SHA256
457f2fa951239f0a9c6801ec3b5493dffd1edd2181d226784a9d147432e69b2c

SHA512
5c0881483ba3f8b94de1005dfcb777fd8171a3642094dfa476eb8540f0fc16cace3c01dd21280c37cbc10d0690279904cc1646c8d1c850be126529194dfa79f5

Download Submit
C:\Windows\SysWOW64\Sys\msnmgs.001

Filesize
3KB

MD5
de670fd93381c051d7e51efa9cd22ce3

SHA1
88810c29d1d7e95e8c074a30f9c647fedbcf55c4

SHA256
b1257eb005c017d2779dfe42d1d45894c11fece9ef547d52bffa20e4eff76e5b

SHA512
0999f495cb22581ddb14c0c020ca22c9bb92cdae34d0a604c086ab4fea426903f99f8dcb145c91af648629649b0247b92f1a53ebfe777090580aa79758fa17f5

Download Submit
C:\Windows\SysWOW64\Sys\msnmgs.006

Filesize
5KB

MD5
ff2bc313174a6ccfe1e0b5b1a58f0f49

SHA1
4e983cdee788faf6a13a9d5bf3f00f4a17dd6e8e

SHA256
f212c83897599d81f4010f1ef3a43e5709e874912072d38d26a5ef5644462318

SHA512
418083066ba5505267f4de91c9e439674e02645c430360dae22dfc390c33b4e0c01857634d1dcb5dc298c296a5f4130397388bceee2ad82ba0a711ab56d1bd0f

Download Submit
C:\Windows\SysWOW64\Sys\msnmgs.007

Filesize
4KB

MD5
50c8c542dca77df82f5925b145567611

SHA1
64bdce386146e3548d3d85cf16fdd0d34cbafe2f

SHA256
0692f76ec589e517f0a5205e658ca44656322c0382cee2af53890324818b3e0f

SHA512
f7df5e9ac0c81f832e8dfe882eb1c4746f30131bef5a56947634146c813df079acd57b3fc954254684c6f4ef291802cd9629e6af3ced9be1f381fdd858a327c2

Download Submit
C:\Windows\SysWOW64\Sys\msnmgs.exe

Filesize
459KB

MD5
4db1b69341dc88b901d85be34278a634

SHA1
0d55d2852a58b597c96c1dcec25efc961d882ba1

SHA256
c3f29e3f8b9eb7c20a0046fc105d2199dc5327a570e8c76908e44be1200fb893

SHA512
e11ee43c65179a562254cc63fda5c25ae228603bd88fd357faea2a5b49b4df11dfde5efe46544ac138d008cdffc419c793b35781ef201a9462a9eda30b52dee0

Download Submit
\Users\Admin\AppData\Local\Temp\@3CB2.tmp

Filesize
4KB

MD5
a9680f653434b4766fdc2a3c592af879

SHA1
fd8e999c43fa83df3144aa5bbaae73bac3834296

SHA256
30e084f531980a35b79dd36ac9ee0022d0aba792da99b3d71eea26d327db9ad3

SHA512
685fe7bbaf9fe5d140f07e9fe0f1eff0cecf8a3a4d050fe917ce8eddac3394ab7b8cea575e2d6f3dace309716662fbb5a9016850b120ea2099a00cfc848f57ac

Download Submit
\Users\Admin\AppData\Local\Temp\Exporer32.exe

Filesize
297KB

MD5
7182d545f06c3bdc69934a83869a46c1

SHA1
8e91a1199713af4f51fc89048cbfbbbeaac3bd95

SHA256
afbb631ba2eb70c5acf3e9a6d1cc16ea3a7f8a640803534cfdd15287ed507054

SHA512
a5ac7055bd2de1d0594a4bc60401e90ac36000d928bf445516f42842d20065ceb49f8716974b03e3e9536d291a10e47efc8129c701676fc05994437fbdccee90

Download Submit
\Users\Admin\AppData\Local\Temp\MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe

Filesize
44KB

MD5
b69b06a60969c86eebb4c573d849650b

SHA1
12aea6493497951573fce2dd9fd0f7be022fe748

SHA256
6f44097a8498624fce354be29ff4d3e35c5ced3b129c33cf9436903cb1c2e368

SHA512
3d5ac6fe1d9364715458353f2274b897769affcd5abc420cc44133cba51f646a6a754bdac10626e99978345e66e3966ff6b9c9c63373d1b2046995a59ca0533e

Download Submit
memory/2656-6-0x00000000021D0000-0x00000000022C5000-memory.dmp

Filesize
980KB

Download
memory/2656-13-0x00000000021D0000-0x00000000022C5000-memory.dmp

Filesize
980KB

Download
memory/2656-66-0x0000000010000000-0x00000000100D3000-memory.dmp

Filesize
844KB

Download
memory/2656-67-0x0000000010000000-0x00000000100D3000-memory.dmp

Filesize
844KB

Download
memory/2748-15-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2748-16-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2748-17-0x00000000002B0000-0x00000000002FC000-memory.dmp

Filesize
304KB

Download
memory/2748-55-0x00000000002B0000-0x00000000002FC000-memory.dmp

Filesize
304KB

Download
memory/2748-14-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/2748-7-0x00000000002B0000-0x00000000002FC000-memory.dmp

Filesize
304KB

Download
memory/2748-59-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download

Analysis

Sharing