ardamax | cab442620da60810693db1b7b638872e8b9c6d6da95a47e4720f6992b2859e98

General

Target

JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
Size

504KB
MD5

7be3ff55bf3bb39b132474013d0d9b89
SHA1

ef45a43e3436f48bb6273b005778448d62c17ffa
SHA256

cab442620da60810693db1b7b638872e8b9c6d6da95a47e4720f6992b2859e98
SHA512

c7b3f93297a3c1034bcb2d8fe3962746289853c196d56866b7e1d67e56d5870a8935a373acaeb1694a3ca67f0fa333cb7966eb4d4c8e6358cd2213ff03d85bde
SSDEEP

12288:8nQeD68whMUVzfb3vsw4qbByUPv3pCwxMdARNNDd/cB:tvMSfsw4sNX3LydSDdcB

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b8d-12.dat	family_ardamax

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\Control Panel\International\Geo\Nation	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\Control Panel\International\Geo\Nation	PHXN.exe

Executes dropped EXE 1 IoCs

pid	Process
4448	PHXN.exe

Loads dropped DLL 5 IoCs

pid	Process
848	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
4448	PHXN.exe
4448	PHXN.exe
4448	PHXN.exe
3216	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PHXN Agent = "C:\\Windows\\SysWOW64\\Sys32\\PHXN.exe"	PHXN.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Sys32\PHXN.001	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
File created	C:\Windows\SysWOW64\Sys32\PHXN.006	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
File created	C:\Windows\SysWOW64\Sys32\PHXN.007	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
File created	C:\Windows\SysWOW64\Sys32\PHXN.exe	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
File created	C:\Windows\SysWOW64\Sys32\AKV.exe	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
File opened for modification	C:\Windows\SysWOW64\Sys32	PHXN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3216	4448	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PHXN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	4448	PHXN.exe
Token: SeIncBasePriorityPrivilege	4448	PHXN.exe
Token: SeIncBasePriorityPrivilege	4448	PHXN.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4448	PHXN.exe
4448	PHXN.exe
4448	PHXN.exe
4448	PHXN.exe
4448	PHXN.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 4448	848	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe	84
PID 848 wrote to memory of 4448	848	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe	84
PID 848 wrote to memory of 4448	848	JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe	84
PID 4448 wrote to memory of 4940	4448	PHXN.exe	96
PID 4448 wrote to memory of 4940	4448	PHXN.exe	96
PID 4448 wrote to memory of 4940	4448	PHXN.exe	96

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7be3ff55bf3bb39b132474013d0d9b89.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\Sys32\PHXN.exe
  "C:\Windows\system32\Sys32\PHXN.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 1112
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:3216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\Sys32\PHXN.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4448 -ip 4448
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@6C66.tmp

Filesize
4KB

MD5
c5c306d45c5b88d004a071941b12b030

SHA1
fcdd3d742203743514f195d6d1060a8475036632

SHA256
2e6181885f8cb215a7291d556100636a7fd2b409cb6df1f65f6c61d058521ec8

SHA512
fdc66e8a5338e60adda51b21bfc5a40b86293d16c5492c82cdbce3cf4f9743c8b49f5e2e4d31c5b827c50c257a08c6dc57d3266ae3eac60ac46ad14684802738

Download Submit
C:\Windows\SysWOW64\Sys32\AKV.exe

Filesize
390KB

MD5
b073e1c34193d3b1ae37dade3152eb45

SHA1
f0b627e8310be12c832d2e14b1818446ffb42dfc

SHA256
8f418775144b64508556ffdfa24a8b6263dcb353fba94872fe8c24391d9bde79

SHA512
0e13f5052e1bc892205366f69fa5262c5fb815f9a9809fd39eeb0787a4fb48328907456f30fece3db19c9a40d0d1cc75cfd430e0c2b9edbd462909c315b6846b

Download Submit
C:\Windows\SysWOW64\Sys32\PHXN.001

Filesize
472B

MD5
83d4cb4598904d247334514811f073a8

SHA1
3e4f7c865679273154722bfec528becd38204dad

SHA256
6b6e2e5d483044e972a452dfaa9009fafa13f465d43ad612060b616112ab801f

SHA512
8ea7c633d39e82003c9902c05fa92d49f7c711294d3b709110ccc8006d534e11cc9a5deed09e77db2109831cbb9b94d40033b5e59f366ddf4dabdc81f51ef173

Download Submit
C:\Windows\SysWOW64\Sys32\PHXN.006

Filesize
7KB

MD5
8f7b2a047e21e5168021c6b6c74b43d5

SHA1
86d6497fa6bfbc8d889479da1180d1b81c6dcf1c

SHA256
d18a1d8bd7bca221016a415a55034e6d47231b5561f3ecf4022c3caea52c00e8

SHA512
a15f0a4280b80db35e99b0a4c8e17fc63f49713b73fbd195ea2b5304bceb733cbfcf6673410dea2c6b83d617f8562fa18dd95574875caac71f81649fc95d2fd7

Download Submit
C:\Windows\SysWOW64\Sys32\PHXN.007

Filesize
5KB

MD5
aef6e96d082b935073a8ae15ba537f63

SHA1
704af73246a277c552c3ed2f859a227413de1b31

SHA256
75e8ce0baa4ccc7249d3d8a594d55744dfb6b6d0d9c272903ba8285ac504ef06

SHA512
a14c6de30455112aa8c8489ad080822f52554e4da087861cc49723e2f24f5bc292723cd5c129cb79fa13534f510a47e7e81173066633cf3716d983f951fc1955

Download Submit
C:\Windows\SysWOW64\Sys32\PHXN.exe

Filesize
477KB

MD5
489644a82021a8b7073ce20ff2ab34c9

SHA1
6384e2e97d957848d3a62af246f94e9c4a9e2f6e

SHA256
51fd851ac6c71b99feaa4d0222ba87e53363c4981f9727d054b97baaeca8eeaf

SHA512
95028425396879a03a003ae6e77f0567e13256a476ecc07779639b131091e206441e13d8a6aac99aef0135c065c6ccead9a9d5677fc63e70ec65f30e2509c872

Download Submit
memory/4448-23-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/4448-27-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads