ardamax | 13702a971a07d4c161ebbd5e1caa026ba54cff8365d24800c4c44a4d14c26cfe

General

Target

JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
Size

502KB
MD5

6dec3d08b6cb7ee70e3bb297f547908f
SHA1

c0ba5a0828dae65e0be78be05d3de95aaa020567
SHA256

13702a971a07d4c161ebbd5e1caa026ba54cff8365d24800c4c44a4d14c26cfe
SHA512

0b4367421213e901335547f343a9b3f2484c3b3b4abd8e757f8f8e57e13afd314c4cf3a11be364cf348bda7f4d11fa76e21904695eb478104ae9ee0eb372cc45
SSDEEP

12288:fG2JXAF7XA0/6gYK/uYu8HcEPayhKsdLkKxGs9:VJXUU4P/uYJLPlgsdLZxGE

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c63-12.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	BIJA.exe

Executes dropped EXE 1 IoCs

pid	Process
2144	BIJA.exe

Loads dropped DLL 5 IoCs

pid	Process
4244	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
2144	BIJA.exe
2144	BIJA.exe
2144	BIJA.exe
4156	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BIJA Agent = "C:\\Windows\\SysWOW64\\28463\\BIJA.exe"	BIJA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\BIJA.001	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
File created	C:\Windows\SysWOW64\28463\BIJA.006	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
File created	C:\Windows\SysWOW64\28463\BIJA.007	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
File created	C:\Windows\SysWOW64\28463\BIJA.exe	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
File opened for modification	C:\Windows\SysWOW64\28463	BIJA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4156	2144	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BIJA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	2144	BIJA.exe
Token: SeIncBasePriorityPrivilege	2144	BIJA.exe
Token: SeIncBasePriorityPrivilege	2144	BIJA.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2144	BIJA.exe
2144	BIJA.exe
2144	BIJA.exe
2144	BIJA.exe
2144	BIJA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 2144	4244	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe	82
PID 4244 wrote to memory of 2144	4244	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe	82
PID 4244 wrote to memory of 2144	4244	JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe	82
PID 2144 wrote to memory of 4588	2144	BIJA.exe	95
PID 2144 wrote to memory of 4588	2144	BIJA.exe	95
PID 2144 wrote to memory of 4588	2144	BIJA.exe	95

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\28463\BIJA.exe
  "C:\Windows\system32\28463\BIJA.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 1112
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:4156
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\BIJA.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2144 -ip 2144
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@81F1.tmp

Filesize
4KB

MD5
d9cb831b02f14f8371acd33c684190fb

SHA1
5035c9ceaf35bf0c14cdc0349d1284beb0e3892b

SHA256
be821327fbd0d0a4b0e61f939349cfaa660a3cbcf037dd8c664a1a52372b32a5

SHA512
452d409cfd53dc8a98e7e9746d7c88e0545df024f1fe5ab81a1ecab84664b8ca7eb8d53d1c66322d49dfe74035d5e6540ad7c95b57757fe91af99bb8edab097e

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
405KB

MD5
dc82dc0d160dbcb878f36801464f7caa

SHA1
ab2f476da88d018b7aa27f8bdd9f15405b49169a

SHA256
a79c4e0c6490d7319ab85d4d4a2bbf9e0c84a8e5af86b52c9ddb8779ffabb8fd

SHA512
e3a8c85871026fdb15261da096aaac73236ceb5e6b60f091fa027565dc6f39ed4b9c27bb4b09d48aed6c5d849464e2e8540e1823e07d9bfbd77422d83125beed

Download Submit
C:\Windows\SysWOW64\28463\BIJA.001

Filesize
418B

MD5
17b61b9d2f53967a3de1d69a29cb61f6

SHA1
8bac9901e16a93b45d476103e5d01b35e05e07c1

SHA256
f50f07614d31c6516130546b2983c978255edebe6efccdae9c094592e93c7e03

SHA512
09e83dae9e54f3e2b7220d280ce0dc1e7a3a77255a4079623ab86da90806507496a14f46e47f4487caaf1adfbf3439af1393499484622342906d8c4977626696

Download Submit
C:\Windows\SysWOW64\28463\BIJA.006

Filesize
8KB

MD5
d06046faed6ce5b6c70786ca53cd79a6

SHA1
18a945748b4aa894487530612e6aaf20c4a5d074

SHA256
fc01b2bcc8f17f707502d7fd5a14217863a1e3e00a8529c2a9e8d46f39ee1412

SHA512
96769913e2a30ccc21deaa7803013d44ae437edee2bf9fc0532055da3c4a6c5de0bb6485da46dca00caab35a43014361713d5282e0783065f9ce5a7523012e90

Download Submit
C:\Windows\SysWOW64\28463\BIJA.007

Filesize
5KB

MD5
2166b0dbd65cc3244d0a2e7695b32a40

SHA1
358e6bbd414ce534c6bf60785281928ca8abcc23

SHA256
6c97872edcb4f6af14d0650f6b9f7256d0081b1d7ff77050e56fbe1d894044d2

SHA512
45e51c7cd899eaa7187d7adee6bf89cf52b4c48908e72499afdfeaf5db5846614a9bfe60773abd551a8e89f718ad5d875cdff3f25f5a80ca219d49418157d6eb

Download Submit
C:\Windows\SysWOW64\28463\BIJA.exe

Filesize
500KB

MD5
a4c7f5f230b30d5e289a092bd915952c

SHA1
db42fb8d2fdf74ddbe6789a4e4a725b41e8612cf

SHA256
531a5334e3132b0df427514b614075800d0cf0f4ada9da4c8a60632b53f3fd5d

SHA512
601475753cf9159670c544d53fbbe31fc7063cb95c905c3e1d5a9bc296482e29ff0abc3e5058f724d622c4aeaf3a35ebff75752828bd7176aae291a51713d56e

Download Submit
memory/2144-23-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2144-27-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads