ardamax | aff0315ba8dc1479ec5a64c9829f9edf32e5e8cd2dbbca82806bd4ec5f32a6a3

General

Target

7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe
Size

500KB
MD5

7ed6161011b9b188b5d2268184173cbd
SHA1

e8bf380730c10f2cd3b4d7339c138f0cab3fed6b
SHA256

aff0315ba8dc1479ec5a64c9829f9edf32e5e8cd2dbbca82806bd4ec5f32a6a3
SHA512

580ae0e20e94e52f9e2122fa53e2815fb4b3e616dcd5097d41f35f34f812dbdb7970a8568a41051306356760034c6051940179770e54edd5dc8faadb83779fed
SSDEEP

12288:4plZfFxNIPO+YEWZmh9oKoPS3jIQCNEdpIo/Jx1WtrJ//qjW:YZfxILWZmLoNPMIQI50xUd/h

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\28463\BHNQ.exe	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

BHNQ.exe

pid process

3580 BHNQ.exe
Loads dropped DLL 1 IoCs

Processes:

7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe

pid process

1600 7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe

pid	process
3580	BHNQ.exe

pid	process
1600	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

BHNQ.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BHNQ Agent = "C:\\Windows\\SysWOW64\\28463\\BHNQ.exe"	BHNQ.exe

Drops file in System32 directory 5 IoCs

Processes:

7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\28463\BHNQ.exe	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\BHNQ.001	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\BHNQ.006	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\28463\BHNQ.007	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exeBHNQ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BHNQ.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe

description	pid	process	target process
PID 1600 wrote to memory of 3580	1600	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe	BHNQ.exe
PID 1600 wrote to memory of 3580	1600	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe	BHNQ.exe
PID 1600 wrote to memory of 3580	1600	7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe	BHNQ.exe

C:\Users\Admin\AppData\Local\Temp\7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7ed6161011b9b188b5d2268184173cbd_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\28463\BHNQ.exe
  "C:\Windows\system32\28463\BHNQ.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@AFF7.tmp

Filesize
4KB

MD5
102f90f4f42551b2acd64923065a2b56

SHA1
18bbbd1a10b603e05816f5a2baf9a6bed74346a3

SHA256
623f4b9a4910c8815d2ab19696668258ff2c30c3adac8967d616f7e60ec619fd

SHA512
2c8338799bcd64083dbe8b0e763424962dd024c52996bae590500b7d844595b539549b6c239f68f3866d5fda9db10808e8e9b489031a1e942bc34277f9a1d9d3

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
411KB

MD5
38defc8742dcd7b684e5ae1193e7e668

SHA1
5710271eb398f63f0f0b209c46460ff9665df9bb

SHA256
b74a277270efc272bef1e264dc11289b7f13c651ac7640745df46bf6792c36d1

SHA512
46cc4b677af570905ac0c36b4e85030a618cefd6e4eb4eb4fc850ad2df45c14233024f0aa655e28649212aa42bf74499a91a682750748f75132aa18d1464cb84

Download Submit
C:\Windows\SysWOW64\28463\BHNQ.001

Filesize
320B

MD5
992e024e2116175080c6e21417724815

SHA1
6f7b7d024175a144d5fb96a808c9bed5008f5b75

SHA256
d1880f97c5b221d451ab7f10562b7765c3e2f5b6208db533c09995db1d15732f

SHA512
a902359c48e21456f9a74001981fc3ad5026b922387eb3f7fc25c00c85031a8a2b840d90779401fe7cf3e7f6df1dac4d6b2015feedee539cde7fcbdb7e2f20bd

Download Submit
C:\Windows\SysWOW64\28463\BHNQ.006

Filesize
8KB

MD5
e44628a2b8e2044ebb635eed3d5f79d9

SHA1
87120d6466ae60ea0df734c578f371c5c77acf3a

SHA256
6742a87a0df8e620ff5314729c94cfaa738daf172220868cb748b09bb4e72ca4

SHA512
ab1ec2ced331a14d60976338715cb9a09144b784d5c3fbcee139e85f843cab9aaa6627ae7a2f7f9d82cda5297fcc045e97385639397acb252bb18ebf315db37e

Download Submit
C:\Windows\SysWOW64\28463\BHNQ.007

Filesize
5KB

MD5
75d6279af7fa9545ba7b7b01a85d2e12

SHA1
2fa39502b0aaa872712068747ff4f0800e955898

SHA256
189a54410440caab60ed99dadf5fed2edcb0d36e5ed3e9a59be41026662bbc0e

SHA512
26c21d6e68fef49d988d4e20da9df164760318087752d4d872275efdc0c667fc31426a916acb8eeb65a0acf20ce3bd3c8953bd34cd83cc46cf44c329469f2ae9

Download Submit
C:\Windows\SysWOW64\28463\BHNQ.exe

Filesize
526KB

MD5
c4e65cee2c8eaf4a4c03852192f49156

SHA1
7c7b416d08056e2ecf215a6ce7126cf74ca3d87e

SHA256
95b5415e32ec93a15a060b6e461151632764cc7693e9d3525e495aa3c9ae1fb0

SHA512
59303381117ced1d99f67fbb10921e34f7ba066edb937ae6e27262941772a48fbe40b861a2954a1e40160b0661f1e2140377ee128ba9600715f6459b65c1bd72

Download Submit
memory/3580-23-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads