ardamax | 4dce1eb91fed394d8d2d54f5c14996d0b9bbf471542d1e55e835287671e9f997

General

Target

b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
Size

1.7MB
MD5

b2af322b192fc3f519fae4c6a7b67a45
SHA1

852a6ab0575c2be323b3424768b7222b710cab0d
SHA256

4dce1eb91fed394d8d2d54f5c14996d0b9bbf471542d1e55e835287671e9f997
SHA512

b0d2a2bfb60267b15c54c6402aef2455534cd03a02729b80c0e3ebed603cddd49b2b9d15d0706f98dd5bfcd7371a7671a05f2246eae993ba203aca8aa8aa257d
SSDEEP

49152:HXTVrVa+WoCvIE1eDPvMaYNA2Kpkx96yW:Nc+WoCTrrA2frr

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer upx

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0006000000019604-8.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2808	QHX.exe
2608	F-CFMOD.exe

Loads dropped DLL 6 IoCs

pid	Process
2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
2808	QHX.exe
2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
2608	F-CFMOD.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QHX Start = "C:\\Windows\\SysWOW64\\JTUQXI\\QHX.exe"	QHX.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\JTUQXI\QHX.004	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\JTUQXI\QHX.001	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\JTUQXI\QHX.002	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\JTUQXI\AKV.exe	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\JTUQXI\QHX.exe	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\JTUQXI\	QHX.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2608	F-CFMOD.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000019605-19.dat	upx
behavioral1/memory/2608-28-0x0000000000400000-0x0000000000542000-memory.dmp	upx
behavioral1/memory/2608-29-0x0000000000400000-0x0000000000542000-memory.dmp	upx
behavioral1/memory/2608-36-0x0000000000400000-0x0000000000542000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QHX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F-CFMOD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2608	F-CFMOD.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2808	QHX.exe
Token: SeIncBasePriorityPrivilege	2808	QHX.exe
Token: SeIncBasePriorityPrivilege	2808	QHX.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2808	QHX.exe
2808	QHX.exe
2808	QHX.exe
2808	QHX.exe
2608	F-CFMOD.exe
2608	F-CFMOD.exe
2608	F-CFMOD.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2808	2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2808	2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2808	2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2808	2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe	30
PID 2716 wrote to memory of 2608	2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe	31
PID 2716 wrote to memory of 2608	2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe	31
PID 2716 wrote to memory of 2608	2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe	31
PID 2716 wrote to memory of 2608	2716	b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2204	2808	QHX.exe	32
PID 2808 wrote to memory of 2204	2808	QHX.exe	32
PID 2808 wrote to memory of 2204	2808	QHX.exe	32
PID 2808 wrote to memory of 2204	2808	QHX.exe	32

C:\Users\Admin\AppData\Local\Temp\b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2af322b192fc3f519fae4c6a7b67a45_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\JTUQXI\QHX.exe
  "C:\Windows\system32\JTUQXI\QHX.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\JTUQXI\QHX.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2204
- C:\Users\Admin\AppData\Local\Temp\F-CFMOD.exe
  "C:\Users\Admin\AppData\Local\Temp\F-CFMOD.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\JTUQXI\AKV.exe

Filesize
456KB

MD5
1f29b1075a91b3da0ccc0b9c49eece56

SHA1
048e675f087181035aedece9e7b11d065c6355cc

SHA256
4f6825548b32329c3360ed9abb7c0a6809a2c2291cf0bcaac511a9fa32a6336e

SHA512
7e152caf055f57f599ecc1e3a404b540b721b3315d2ba16bff6eb21f03edeb3a06ae185621e3139293612d94210f500f098bd281489ca7f336efd8b5284ee060

Download Submit
C:\Windows\SysWOW64\JTUQXI\QHX.001

Filesize
61KB

MD5
31c866d8e4448c28ae63660a0521cd92

SHA1
0e4dcb44e3c8589688b8eacdd8cc463a920baab9

SHA256
dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1

SHA512
1076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839

Download Submit
C:\Windows\SysWOW64\JTUQXI\QHX.002

Filesize
43KB

MD5
093e599a1281e943ce1592f61d9591af

SHA1
6896810fe9b7efe4f5ae68bf280fec637e97adf5

SHA256
1ac0964d97b02204f4d4ae79cd5244342f1a1798f5846e9dd7f3448d4177a009

SHA512
64cb58fbf6295d15d9ee6a8a7a325e7673af7ee02e4ece8da5a95257f666566a425b348b802b78ac82e7868ba7923f85255c2c31e548618afa9706c1f88d34dc

Download Submit
C:\Windows\SysWOW64\JTUQXI\QHX.004

Filesize
1KB

MD5
be2be7b1cc38097baf1aefd1cb05de58

SHA1
e7efaa5a7f576f0a043a703846212c8be799d3c4

SHA256
5cbe3a29e1b40af776058cd086ddee77e8cc30a985d8064b2edabff2d3e30c58

SHA512
b26db0a9f40cf159ca572f16e0b6e518c6c58fecd60234086ab330c20365fc3525537bbba5913ae67b13fa9c456c31af154c7b3baa62e1397a5bcf2bd2961a9a

Download Submit
C:\Windows\SysWOW64\JTUQXI\QHX.exe

Filesize
1.5MB

MD5
0aaffc12ef1b416b9276bdc3fdec9dff

SHA1
9f38d7cf6241d867da58f89db9ff26544314b938

SHA256
42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b

SHA512
bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c

Download Submit
\Users\Admin\AppData\Local\Temp\F-CFMOD.exe

Filesize
644KB

MD5
604299c4624ffba32504ca7beb65b9ae

SHA1
48031cc42b8979799bb3da78c67e3b8ca911fc47

SHA256
e05501b6c29b78b7c9a00e482fef3d38571e1df980905fe488c976e47f2b2496

SHA512
ccc0cce3d8171525b3427964824ffa0ee42349a3644b4345345275807c192667a58969bcca46bb9b73e3d236aa6d5a152b50f15479bfd77eeac5b5fb4040f4bc

Download Submit
memory/2608-28-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/2608-29-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/2608-36-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/2716-27-0x0000000002FD0000-0x0000000003112000-memory.dmp

Filesize
1.3MB

Download
memory/2808-16-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2808-37-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads