ardamax | d8d8e37ad3d769b035e656c26973e09b82a209005b1a103529c1783dc8c02e2d

General

Target

JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe
Size

438KB
MD5

c567e2129ce287512c209b6d209f780f
SHA1

50a15982eacff483d97a19990a191c9511270e7c
SHA256

d8d8e37ad3d769b035e656c26973e09b82a209005b1a103529c1783dc8c02e2d
SHA512

5dc8e0a706a07c94c34f09cf36e96863bbc371994e09446b63c2e20469251d4849602e7f26bc575cce66dafdcf33e7aac8106ee9d2b2ad7933acb8180a4644dc
SSDEEP

12288:6Jw3phAQmsiXLdkQTt6R/u2eCaVlDzkzr5y3QIv1:tZ5md2QTtat+V9wzr5y3dv1

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023e24-12.dat	family_ardamax

Downloads MZ/PE file 1 IoCs

flow	pid	Process
31	4624	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895555807-3853795127-2958627047-1000\Control Panel\International\Geo\Nation	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe

Executes dropped EXE 2 IoCs

pid	Process
4664	isas.exe
3404	tibiaauto.exe

Loads dropped DLL 4 IoCs

pid	Process
4628	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe
4664	isas.exe
4664	isas.exe
4664	isas.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\isas = "C:\\Windows\\SysWOW64\\isas.exe"	isas.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\isas.007	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe
File created	C:\Windows\SysWOW64\isas.exe	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe
File created	C:\Windows\SysWOW64\isas.001	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe
File created	C:\Windows\SysWOW64\isas.006	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64	isas.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tibiaauto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
760	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4664	isas.exe
Token: SeIncBasePriorityPrivilege	4664	isas.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4664	isas.exe
4664	isas.exe
4664	isas.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4664	4628	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe	86
PID 4628 wrote to memory of 4664	4628	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe	86
PID 4628 wrote to memory of 4664	4628	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe	86
PID 4628 wrote to memory of 3404	4628	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe	87
PID 4628 wrote to memory of 3404	4628	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe	87
PID 4628 wrote to memory of 3404	4628	JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c567e2129ce287512c209b6d209f780f.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\isas.exe
  "C:\Windows\system32\isas.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4664
- C:\Users\Admin\AppData\Local\Temp\tibiaauto.exe
  "C:\Users\Admin\AppData\Local\Temp\tibiaauto.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3404

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0NCMjM4RTYtMDYyRS00OUE5LThFQzgtRkI2NzgyOTY4QzM4fSIgdXNlcmlkPSJ7MkQxRDBCQzUtODBENS00MjYwLTg5OUUtOEYzQUNBNEQ2NTYxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RUE3REQ1OTMtRTgxRS00RkM4LUExRUItNUQ0QzVBQjI5NDg0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4MzAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTE0Njg3NjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTE3MTk1MDc4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@7C06.tmp

Filesize
4KB

MD5
de3f9e4f680ff22e8712fa9b32ff85ee

SHA1
0cc885ed6502b3b610af57ee2095410751d9dd78

SHA256
477f789ffe931ee11197de814231fdc770e6e6c1e94b0fec5bee0adecd32dd03

SHA512
daf04bb16fec1130dc08e72b7f28b0041b2eb78900e1464e15f1e20e1705a0de24d3df0de8111a42aed03d73db6f8eb5e30c87f34b4a745d4aa27d84e09d9f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\tibiaauto.exe

Filesize
244KB

MD5
f0bd7177035aa03b81b0314a4fa57a41

SHA1
3b178a39fa4651a1c017868fba0a86a92a4e9717

SHA256
2a84fa0e1766bf42f5db7b94a2edbf8f9936e2f1d1f45ed65b0b6bca7610cbb0

SHA512
e67d8421eb0cb1425039ec5b1d5bd45585939a92d42f4f013036b514a3d7ec2b0c96ca99af6c60dea00ede2cf1395f0218ec6543c3af4efa998596a2917a3eaf

Download Submit
C:\Windows\SysWOW64\isas.001

Filesize
1KB

MD5
8cf61a795266ac232eadad6d30771169

SHA1
84b07da02ea4677d9900fdc9215ec96ded99e4fa

SHA256
39856dbd549b63f06ed4ca0055bbd643e00e761dc870fd558ef9b4fd631f0652

SHA512
25624037cca1ec7e6f879b67297e76f0a5573a9df04c634e611c5c8e12444291bd5e70381dfbe666b3600e0aa506e3a149d6a95ed369e3cdd754be58db78b38e

Download Submit
C:\Windows\SysWOW64\isas.006

Filesize
4KB

MD5
1153fe5fbe61266713539cae72d87ad3

SHA1
245047d3d158f4eda34290ed22e4bb13a28f9539

SHA256
3b2700a8033916afd0e89ab5519702720f35b94a570ebe865df113f2aacda16c

SHA512
24058cdebaf8ccfc00622301927b221116b846c2a8acf8f0935ba30e0d716bfecd6ab07aaf8d93030ec2149ee98eec5f6d2395ee8a1a62ad00e07124447c107c

Download Submit
C:\Windows\SysWOW64\isas.007

Filesize
6KB

MD5
049989542b610261bde51aff6b71d4aa

SHA1
22de68b6548faf1ec1b52f14a1f197fa5152babd

SHA256
48cabcd5da354d4018809d12ca445c4c6324250f22450aca04222c214b9ae42d

SHA512
8cc0cb8167598e50a91230061cbe12d0d724151dc454f6cf0dcd5074efc704602796a9a136e53f609a6d54ad6c468aff2db263ad72b4b7d7febd32656eece34c

Download Submit
C:\Windows\SysWOW64\isas.exe

Filesize
231KB

MD5
79c6903c4794af027053331946137b26

SHA1
b688916709014fc874c5b7870553105a9961c652

SHA256
f3cbf3dd3f229f6119a8be5357959b77af1a43f9d568a7febe9a06f7593b20ed

SHA512
ac28813dcdc38ff1b0736b1673ced7e35d7da5667b0224b88952908564373ae61aff1b0f03d27e40b613559c8d4e37c402269791db2ed1311f62d069a2e5111e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads