ardamax | 0e039b353d84e6aa1dc31a3dc854a8926c5d9f8a27cddf21dffabad7d440bf52

General

Target

JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe
Size

956KB
MD5

bab1aed55fbfbfcac6c404299b651053
SHA1

6886d6432f2371499ba8a58e993feb3341c66fab
SHA256

0e039b353d84e6aa1dc31a3dc854a8926c5d9f8a27cddf21dffabad7d440bf52
SHA512

cca801f0a810ca44d379eacccc670f0831a7d96f9aba621a8e30d8255481782beb839d8c431317bfb82dc9b81d9688147d86e19cddded6e54656341a9452cc77
SSDEEP

24576:FzwTT6vYvVnFqSdWWFdgf8G7kA4wFPx1kp3qt3zbMAZhg2iL2LRJg:Fz+TfzUWEfFP4wd+g30gN

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023daf-7.dat	family_ardamax

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	708	Process not Found

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3591594829-2464889670-1367169939-1000\Control Panel\International\Geo\Nation	RXR.exe

Executes dropped EXE 1 IoCs

pid	Process
456	RXR.exe

Loads dropped DLL 1 IoCs

pid	Process
456	RXR.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RXR Start = "C:\\Windows\\SysWOW64\\QHXTHC\\RXR.exe"	RXR.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\QHXTHC\RXR.004	JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe
File created	C:\Windows\SysWOW64\QHXTHC\RXR.001	JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe
File created	C:\Windows\SysWOW64\QHXTHC\RXR.002	JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe
File created	C:\Windows\SysWOW64\QHXTHC\RXR.exe	JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe
File opened for modification	C:\Windows\SysWOW64\QHXTHC\	RXR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RXR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2640	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
456	RXR.exe
456	RXR.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	456	RXR.exe
Token: SeIncBasePriorityPrivilege	456	RXR.exe
Token: SeIncBasePriorityPrivilege	456	RXR.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
456	RXR.exe
456	RXR.exe
456	RXR.exe
456	RXR.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 456	3268	JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe	85
PID 3268 wrote to memory of 456	3268	JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe	85
PID 3268 wrote to memory of 456	3268	JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe	85
PID 456 wrote to memory of 1372	456	RXR.exe	91
PID 456 wrote to memory of 1372	456	RXR.exe	91
PID 456 wrote to memory of 1372	456	RXR.exe	91

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bab1aed55fbfbfcac6c404299b651053.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\QHXTHC\RXR.exe
  "C:\Windows\system32\QHXTHC\RXR.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\QHXTHC\RXR.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1372

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0IxOUQ2RjItREIyNi00RUVGLTlEN0UtOEE0Q0M5NTk5MkJBfSIgdXNlcmlkPSJ7RDY1NTRDNUUtQ0U1OC00MEJELTlBNEQtMTYwMjkyMDUwQzdFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NEEzOTY0M0EtMTM0My00QTM1LUFCMjItMUU2QTYzNzQ3QzM5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU1NzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODAxNjUyMzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTY0NTA2Njg4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\QHXTHC\RXR.001

Filesize
61KB

MD5
9681d3e1f2c53ad98b8467b3acca33fc

SHA1
04d5d08781f27d6e08ad0262f7325b2be4db7743

SHA256
baecddca15ea6932b9cd4e7f5bae848c3c290660a85c408b898150c6f8fd744e

SHA512
5c6191fb676ace9d1c2ddfd4e98651959ab24b718ab626c343e2bb271d31edd8ba43ed9de528c7832ddcc2137d2424c22bb19f115dc252e1400cfcd3edce2098

Download Submit
C:\Windows\SysWOW64\QHXTHC\RXR.002

Filesize
44KB

MD5
e65e4bdb2c86226589b88f101153c01b

SHA1
731be43621721dba20f0bb74966ea08043ef37fd

SHA256
e8a9477bc04824357c0f0bcc1cb665e1dfb6cf5c05f68517749f6cb11821cec2

SHA512
7700ee197f109a8f2cff2e529715e371e36c1d9924af0bedef9285f76898d3448847af3bff342813b9bd8ca619b7c39b9607150596008ffc6fe68b338f6769cd

Download Submit
C:\Windows\SysWOW64\QHXTHC\RXR.004

Filesize
1KB

MD5
dff7e39076c4dc4f175c4d811b6a0089

SHA1
14910843ddc1ce3b997df61ae103cac4af61ac2b

SHA256
e6862e9e749f29436be6c40627ed60964f46f86b5060cab7df064435f3fbc874

SHA512
d7397cb254126080b2a9b3c4fbb59d7cdb1aba8e46528c3df6b54099a4d886ff566d0c3829f6da751dc487076c2069068f0d1dec4a66ee9f8ce631bed879e04d

Download Submit
C:\Windows\SysWOW64\QHXTHC\RXR.exe

Filesize
1.7MB

MD5
9a6a50772539f5a61fefa29c34666223

SHA1
b2b8650d817ef7d86bfef48420e9716f0ffdccce

SHA256
93db12799d366bbb10f28b923188e3f1457b3ec931ddf33ddeb131a80e46f00b

SHA512
eb5f89e6b27981d85dc235edc477a4397d08b9e89d638b0e07301a26ca6e640f12251fdcfe1386df4167a2928bc60959289329531bc7a9e14a232ead22935fed

Download Submit
memory/456-14-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/456-16-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads