ardamax | d9c06711926d23d2c0b85447a75e0b5ba6af0d94afcb79cfb6915c72ada1b135

General

Target

ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe
Size

675KB
MD5

ab96d11e6643d675c853f83753b51c1e
SHA1

f388ead80109ec4f714d48e841ae9188f89b61ee
SHA256

d9c06711926d23d2c0b85447a75e0b5ba6af0d94afcb79cfb6915c72ada1b135
SHA512

d13b965dae013d6ea2d681c63450fad4c0f18cbd3afac211b84eac3064920f13d3cdd4c4476843cab463195431cb52f7eb99393a227421d8bf89d33488315c95
SSDEEP

12288:fTdED8z8zfnAUU2YgzPo3QL/wkZOrPm9lU9e7NYAg+q:pEuym2YgzPCQLxOrPmlU9SN5Lq

Score

10^/10

ardamax discovery keylogger persistence stealer upx

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000015da7-11.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2688	system32UXNG.exe
2812	LogitechMaster.exe

Loads dropped DLL 3 IoCs

pid	Process
2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe
2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe
2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system32UXNG Agent = "C:\\Windows\\system32UXNG.exe"	system32UXNG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015e18-26.dat	upx
behavioral1/memory/2756-25-0x0000000002A00000-0x0000000002A95000-memory.dmp	upx
behavioral1/memory/2812-28-0x0000000000400000-0x0000000000495000-memory.dmp	upx
behavioral1/memory/2812-36-0x0000000000400000-0x0000000000495000-memory.dmp	upx
behavioral1/memory/2812-52-0x0000000000400000-0x0000000000495000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32UXNG.007	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe
File created	C:\Windows\system32UXNG.exe	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe
File created	C:\Windows\system32AKV.exe	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe
File created	C:\Windows\system32UXNG.001	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe
File created	C:\Windows\system32UXNG.006	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32UXNG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LogitechMaster.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2812	LogitechMaster.exe
2812	LogitechMaster.exe
2812	LogitechMaster.exe
2812	LogitechMaster.exe
2812	LogitechMaster.exe
2812	LogitechMaster.exe
2812	LogitechMaster.exe
2812	LogitechMaster.exe
2812	LogitechMaster.exe
2812	LogitechMaster.exe
2812	LogitechMaster.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	LogitechMaster.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	LogitechMaster.exe
Token: 33	2688	system32UXNG.exe
Token: SeIncBasePriorityPrivilege	2688	system32UXNG.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2688	system32UXNG.exe
2688	system32UXNG.exe
2688	system32UXNG.exe
2688	system32UXNG.exe
2688	system32UXNG.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2688	2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2688	2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2688	2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2688	2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2812	2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe	31
PID 2756 wrote to memory of 2812	2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe	31
PID 2756 wrote to memory of 2812	2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe	31
PID 2756 wrote to memory of 2812	2756	ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab96d11e6643d675c853f83753b51c1e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32UXNG.exe
  "C:\Windows\system32UXNG.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\LogitechMaster.exe
  "C:\Users\Admin\AppData\Local\Temp\LogitechMaster.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LogitechMaster.exe

Filesize
203KB

MD5
6acfdb6f768497ecaadbd68cd544146f

SHA1
b37b007426393a7e0d0e5e5efd95de0b176e2078

SHA256
80421e3cb9d2c0bb1652e19f48cdcf49d33533fb558d6b3cdd045fac070e3263

SHA512
cb707cb05c2817f5ef5584eb6656d9f6e001756e12c3935bdca28d52a427e06c99438cae376f0b8238cefbba1ef84fd7c74ba89072bec14b2d4f83be7388efbe

Download Submit
C:\Windows\system32UXNG.001

Filesize
406B

MD5
52c3c986cb3f0cad8982213316b7bee0

SHA1
4663d5e50eb4bc0b85f5052584fb6249551783dc

SHA256
97c33fa04d3fda9bf75e40b1bcf151e0b4b49a67c7d0679e02333201aa147402

SHA512
e1307120b3bd44cafdc32f0016789ad10cf01b7b5c8e1a152b825a7dcd31017a9543b93030a6d973029a941dd8be011116769bd72403f513fd0c2200ee5409a1

Download Submit
C:\Windows\system32UXNG.006

Filesize
7KB

MD5
ed3c7e9a789e0c5c8c49e46d4bf6a3df

SHA1
e74e617680edd83ea0172960c4389ba3f7ed431d

SHA256
f2b983e3e8cdcad665bdd0024725bb03a1a4919dcf115d031d1d4e4fe3225856

SHA512
1c70224ccf2d95563d54c8eb52e0e3fc09dee8528a8a0041517f1f85f36eec5f08ed5b8e9064827290a7b66f48849575ecb2cce3e81b4250e12806ffb7aff06d

Download Submit
C:\Windows\system32UXNG.007

Filesize
5KB

MD5
d7b3b4076038485800c17684ac22550f

SHA1
d6ce8bc1a16d46cf6bdae41308f4eafd8d24ae4f

SHA256
7f67f9360d43cc337ad5f878372e1eec94a83e7cf6b5cf56c43a8c7e2e8d869a

SHA512
209eae97c7854f26fb32132be5722a5fb7b0c275774599b456b3f8a99c5b70d90a676ecf17ab7867c47a0f653c3f7d80d02d902ddb116acb7ba366ab0662750b

Download Submit
C:\Windows\system32UXNG.exe

Filesize
471KB

MD5
186403d9ea3c30fb5c9cc7ec135c7866

SHA1
0b2ee531ae2f5c0658ffa720c1c71e986433a4fc

SHA256
99b102ae1b219cc471c47aa54da4ab4c3f4d0ee7a07ef85c7f0bca8cc6eb9bf1

SHA512
af30f64237e9998c4c2c41213a67c0bbf8687318c8e957f8a87aff43e383dd301ca674e0158cde5ab209bcf03263625fefcd0b6602c14f3d40231da7d9809dcd

Download Submit
\Users\Admin\AppData\Local\Temp\@4412.tmp

Filesize
4KB

MD5
51bee0ab97691836dc058cc6edb0a3bc

SHA1
e7a79d9eeaa9b3eb4650389d590e72f3305767d4

SHA256
fcb57ac50b7ced25bba2f806824dbbbcdf26208a1ceb2244c6f52a572b1f5f06

SHA512
92e15cf965bf2e4c258e6bf53543647b470fba9376c0fb3e9cc8d003f3be74f87f7d7935cf67b66205f1cc103df613856e2aef129a4b373336b1f0f1b5645fcc

Download Submit
memory/2688-39-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2688-40-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2688-37-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2688-29-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2756-35-0x0000000002A00000-0x0000000002A95000-memory.dmp

Filesize
596KB

Download
memory/2756-25-0x0000000002A00000-0x0000000002A95000-memory.dmp

Filesize
596KB

Download
memory/2812-34-0x000000007770F000-0x0000000077710000-memory.dmp

Filesize
4KB

Download
memory/2812-36-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2812-28-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2812-38-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2812-30-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2812-42-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/2812-43-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/2812-49-0x000000007770F000-0x0000000077710000-memory.dmp

Filesize
4KB

Download
memory/2812-52-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads