ardamax | df6764f8905bee1924b5a41f4b7dc5a4a91d6c3d3f2c9b5b15e2742bbf1663f7

General

Target

d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe
Size

1.3MB
MD5

d2624e9e60cddb53b78bf2b489b44a78
SHA1

3885dbdb9721df95545d158a9009e82f15183bde
SHA256

df6764f8905bee1924b5a41f4b7dc5a4a91d6c3d3f2c9b5b15e2742bbf1663f7
SHA512

c89d95548d47f5fb0e939fc2a1f894022de5062d25092d142bf02654553a7fbaafc75b9ae1f9547bfcb4fead7e58d5ae9bc1b41cbf162e4e1fd87a0c6c0fba24
SSDEEP

24576:1b6z0hJADmZNqCdqhb3C4MfLGTSyx8IaZkmWXP0/ZxwDW0Ax5DZlUjEuL9X:R+0b891b3CtKGyC1kTP0/ZGDu51lUjEi

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b7a-16.dat	family_ardamax

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Funny.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	BWM.exe

Executes dropped EXE 2 IoCs

pid	Process
3444	Funny.exe
2028	BWM.exe

Loads dropped DLL 2 IoCs

pid	Process
2028	BWM.exe
4768	NOTEPAD.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BWM Start = "C:\\Windows\\SysWOW64\\VQJWLQ\\BWM.exe"	BWM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\VQJWLQ\BWM.004	Funny.exe
File created	C:\Windows\SysWOW64\VQJWLQ\BWM.001	Funny.exe
File created	C:\Windows\SysWOW64\VQJWLQ\BWM.002	Funny.exe
File created	C:\Windows\SysWOW64\VQJWLQ\AKV.exe	Funny.exe
File created	C:\Windows\SysWOW64\VQJWLQ\BWM.exe	Funny.exe
File opened for modification	C:\Windows\SysWOW64\VQJWLQ\	BWM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BWM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Funny.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	BWM.exe
2028	BWM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2028	BWM.exe
Token: SeIncBasePriorityPrivilege	2028	BWM.exe
Token: SeIncBasePriorityPrivilege	2028	BWM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2028	BWM.exe
2028	BWM.exe
2028	BWM.exe
2028	BWM.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3444	1288	d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe	83
PID 1288 wrote to memory of 3444	1288	d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe	83
PID 1288 wrote to memory of 3444	1288	d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe	83
PID 1288 wrote to memory of 4768	1288	d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe	84
PID 1288 wrote to memory of 4768	1288	d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe	84
PID 1288 wrote to memory of 4768	1288	d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe	84
PID 3444 wrote to memory of 2028	3444	Funny.exe	85
PID 3444 wrote to memory of 2028	3444	Funny.exe	85
PID 3444 wrote to memory of 2028	3444	Funny.exe	85
PID 2028 wrote to memory of 1520	2028	BWM.exe	103
PID 2028 wrote to memory of 1520	2028	BWM.exe	103
PID 2028 wrote to memory of 1520	2028	BWM.exe	103

C:\Users\Admin\AppData\Local\Temp\d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2624e9e60cddb53b78bf2b489b44a78_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\Funny.exe
  "C:\Users\Admin\AppData\Local\Temp\Funny.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\VQJWLQ\BWM.exe
    "C:\Windows\system32\VQJWLQ\BWM.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\VQJWLQ\BWM.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\New Text Document.txt
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Funny.exe

Filesize
1.2MB

MD5
e3880e06ac84780252ba68f3d9541f39

SHA1
011ff4cdb9cb86e7c7e6c6b975c187cf129c3e9f

SHA256
e28247aeaa2db782bc9754f266c6db5bc90dfd9fa6a207a0787060b2fec44e99

SHA512
7111904dd86249d9efe2651b905f3792479b3b524bd33848e758e584c5ceebdeabe7f904dd72314a56cbdbe31f15bfb23d99904ad5125bf26653e80fedeba186

Download Submit
C:\Windows\SysWOW64\VQJWLQ\AKV.exe

Filesize
485KB

MD5
b905540561802896d1609a5709c38795

SHA1
a265f7c1d428ccece168d36ae1a5f50abfb69e37

SHA256
ce666ce776c30251bb1b465d47826c23efaa86ec5ee50b2a4d23a4ceb343ed53

SHA512
7663654f134f47a8092bae1f3f9d46732d2541ab955e7604d43a0def1e61e2bc039a6753e94d99f1d04b69f55a86f1fb937513671019f1bdf100edb97b24badc

Download Submit
C:\Windows\SysWOW64\VQJWLQ\BWM.001

Filesize
61KB

MD5
0e7e847fb96b4faa6cb4d3707a96887e

SHA1
896fd4064044e271312e9128e874108eec69521f

SHA256
c0f3e18ed0020dae5f75d3338b51f9c8de26d8af0a4d31904ba77cb1d112bbca

SHA512
ad680ed30b0cabe1be4e7237b8e620060de9c5f64d088d21a6acf6f293551ab4abc10f8f959aa6041e19aeaea538e72beeecc29b7669546a9a151141d4e73684

Download Submit
C:\Windows\SysWOW64\VQJWLQ\BWM.002

Filesize
43KB

MD5
f195701cf2c54d6ceadad943cf5135b8

SHA1
9beb03fc097fc58d7375b0511b87ced98a423a08

SHA256
177c1dcc7f13158445f0b99713e9cad205da86e764940a48d43dc375565b0dec

SHA512
f78def1ab431bb2b7b647ec76c063c30a87cabd22605f94cbe4fbb6f757fd54ddf7861d3842a0e369abfce94b68d41dec0fe2322a74f67d9875f561f92b20025

Download Submit
C:\Windows\SysWOW64\VQJWLQ\BWM.004

Filesize
1KB

MD5
be3db2bf5f4a6830b22415651625d7f3

SHA1
f8a41ec6af3e270b19c64a84dce6abcfd544e9be

SHA256
32ea211e684d48f90fed84fe48ce1d3ea48343b57e292b86415eeec4a5cdd2e4

SHA512
a832c3071233f30971f53567cd01a8b073e7cc7b3bbaeaa5dc80eaebdf805d8645272d9da4f7942167cb0da1dd9c6e4c85f8a981d1dd89178c0536b820ba2dfd

Download Submit
C:\Windows\SysWOW64\VQJWLQ\BWM.exe

Filesize
1.7MB

MD5
d95623e481661c678a0546e02f10f24c

SHA1
b6949e68a19b270873764585eb1e82448d1e0717

SHA256
cecfadce6fb09b3977c20d15fb40f8f66a1d7e488a4794451d048a598c3417da

SHA512
dee02644d92ed30e88bb10e9dcdba97abd9949b230059ec20cf5d93061f9cdb77b1e793e5f69d0b51595c30077c3ddd093348d22b070ce898ccefe28b8062591

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads