ardamax | aabb0cd30e28d1c4efad9fbefd8deaa5d5ee390182a28e2c1f08fcfa011f059b

General

Target

JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe
Size

2.7MB
MD5

34d5c1f08f758fea569cc2ca9673191f
SHA1

dde401e304c5a34b0ec0890753fda71721dd8d32
SHA256

aabb0cd30e28d1c4efad9fbefd8deaa5d5ee390182a28e2c1f08fcfa011f059b
SHA512

1bd6c7a7a72a1b3831bed7d982e7d9e4d2ac13d35b89bfc3caa058943e4c91a342317b8a33a1b06857b7d18b8e7dedb4c75a5fcb42805c362756473426295670
SSDEEP

49152:RBCyAhuO1T5UmAgL6l9r3paHreU3eBAIwMxdm+JZIBtE982xu:+yAhuO1T5UmAgL6l9r3paHreSeBAIwM+

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023cb0-34.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe

Executes dropped EXE 3 IoCs

pid	Process
2176	EliteSwitch.exe
532	Install.exe
4948	LQJQ.exe

Loads dropped DLL 4 IoCs

pid	Process
532	Install.exe
4948	LQJQ.exe
4948	LQJQ.exe
4948	LQJQ.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LQJQ Agent = "C:\\Windows\\SysWOW64\\28463\\LQJQ.exe"	LQJQ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\LQJQ.001	Install.exe
File created	C:\Windows\SysWOW64\28463\LQJQ.006	Install.exe
File created	C:\Windows\SysWOW64\28463\LQJQ.007	Install.exe
File created	C:\Windows\SysWOW64\28463\LQJQ.exe	Install.exe
File opened for modification	C:\Windows\SysWOW64\28463	LQJQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LQJQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EliteSwitch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4948	LQJQ.exe
Token: SeIncBasePriorityPrivilege	4948	LQJQ.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	EliteSwitch.exe
4948	LQJQ.exe
4948	LQJQ.exe
4948	LQJQ.exe
4948	LQJQ.exe
4948	LQJQ.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 2176	3972	JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe	83
PID 3972 wrote to memory of 2176	3972	JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe	83
PID 3972 wrote to memory of 2176	3972	JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe	83
PID 3972 wrote to memory of 532	3972	JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe	84
PID 3972 wrote to memory of 532	3972	JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe	84
PID 3972 wrote to memory of 532	3972	JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe	84
PID 532 wrote to memory of 4948	532	Install.exe	94
PID 532 wrote to memory of 4948	532	Install.exe	94
PID 532 wrote to memory of 4948	532	Install.exe	94

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Users\Admin\AppData\Local\Temp\EliteSwitch.exe
  "C:\Users\Admin\AppData\Local\Temp\EliteSwitch.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2176
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\SysWOW64\28463\LQJQ.exe
    "C:\Windows\system32\28463\LQJQ.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@BA76.tmp

Filesize
4KB

MD5
fc0fea286539e5d84ccf49020ca3823b

SHA1
d43711c776edf9a07abed6bb95ed4a0e45e14d52

SHA256
2520256a587481813a5557e54a65f2fca97baee5df333102adfff2dbdabb4828

SHA512
70e1a5ec247d5e3057fe19f7f34b31ee7a79ab16dca73794829d9d81e3ed891881df424f7aa44b9424550574ab61c95d376163b16080aa7cfd61e986e6988ea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\EliteSwitch.exe

Filesize
2.4MB

MD5
d97e40003a44f536f104d39e791b1f91

SHA1
d9be56241887aacc812ac5038c49be9a412308d6

SHA256
203c038ad2d7b94b70bf5b33732dbc55b2f508f5439882884ae90106a7c3f097

SHA512
250abc156be8ab52d1dfecf192d7299b558b14c16ebbdb7900dff4111c3e03deac303081ea048da9f9aa8f794197c72d1c0376595aeb9c11db6b82506c9593a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe

Filesize
283KB

MD5
5fcd58603b6befc359ccf58ce1e1d276

SHA1
f5eec52141daa9d347fe67de694522acc4f20279

SHA256
42f0c9d211b10125143ecfcc9b4448d0c0d5a2966e8c2dd2bee71c027ca81124

SHA512
05b8e38f7c7827eb3eb272df29dae4f554a40077c207558c158823a463e8ec03de934fdb3e3d0bb563454b5a52f8be9cd1889ae2280605b35f218677570ee100

Download Submit
C:\Windows\SysWOW64\28463\LQJQ.001

Filesize
428B

MD5
8b06e2e6f38da57ba9afec9cf9726265

SHA1
bfd8b3c1214421d4de8e05854fa9fb46de3583b6

SHA256
b9cc408585474c072f4559f0af93a8af6f75d0d8851cce4d1c7fd69f64a719d0

SHA512
0c3af6a64424fd5cfaa0cf298eb8513c9477c23d23e1ef85d7b378fc63fc86f73624fdfba2036d8c10971d27f8f5d02d78620b97455f60890074c64db2491f0a

Download Submit
C:\Windows\SysWOW64\28463\LQJQ.006

Filesize
8KB

MD5
75f215af21ded98ab7a1a2a0ea1f1a30

SHA1
e85649693a178064da1aa4cc7c8e34c92472ba0d

SHA256
af46dca2a4f77f0c977fec74312a41e20bd064bd2ca17bec0f09afd67d7e1e3d

SHA512
1582847dae80134e5272fc1b125d6af13746263601ebc8b540ea5fd3e4fc0a05f6e783c59a6052b971efd15d26d9d55b86345292160e9c79041b7c57f9a74f54

Download Submit
C:\Windows\SysWOW64\28463\LQJQ.007

Filesize
5KB

MD5
528f383007234b421e3f1072fae5af11

SHA1
b19c49e17263d940ffa4d46c60a7cf2d03525f09

SHA256
531958a2b1de11d2da2eb8a5409f57c1f31253f79f790473d0efc0ae5567b61f

SHA512
d1813fc77b21ebcdada0cc9c410e533a39a436a038d91cb131bf03c987dab6e7e5b4c99f1a135adde84b4afcbd0a9f0f13931bae3c45c5782d7557fa620b4830

Download Submit
C:\Windows\SysWOW64\28463\LQJQ.exe

Filesize
513KB

MD5
1800b0b263035d94f7bb5e9e70270032

SHA1
c8ba77fa2e414ad11e39a6493e15c078c99d80e6

SHA256
0b15e820894e38d036e75abd442e1cebbfb734c4a50fd0f3adcd3b77211caa5e

SHA512
1431bedcba045f110354c7ec8a34ad5677447aa647581ebc86c25ee38397d2eff4b02d438227144b934ce65b26a2be65c44b761bd4b46518ff44ba6aaf06f29f

Download Submit
memory/3972-21-0x0000000000400000-0x00000000006BB000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads