ardamax | a882a48450f64f222b6de108a794aa8db33da2f5e854a93a96969e71157e86ba

General

Target

JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe
Size

880KB
MD5

f3ac8fc094262583378913a5fab26475
SHA1

a9dd163f09f0f618e73d12896065aa0d1470a3e9
SHA256

a882a48450f64f222b6de108a794aa8db33da2f5e854a93a96969e71157e86ba
SHA512

58ba5d6146ecb2b3cda43ee54fcb04b2d27623f2a6d98301f67bd22ce116c10bd5b1e59a52ea58d3a2ea5588914675df217a4fd084f5cd14dce05f6eb8a93caa
SSDEEP

24576:nKJSjpVl1rwKG365j8McJTaEcQ7D2ZkGTTgNBe2:nKQ7T5oaEeFTQBz

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023d1a-12.dat	family_ardamax

Downloads MZ/PE file 1 IoCs

flow	pid	Process
31	1112	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3932017190-1449707826-1445630-1000\Control Panel\International\Geo\Nation	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe

Executes dropped EXE 2 IoCs

pid	Process
948	ISXD.exe
2040	setup_akl.exe

Loads dropped DLL 3 IoCs

pid	Process
1904	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe
948	ISXD.exe
2040	setup_akl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ISXD Agent = "C:\\Windows\\SysWOW64\\Sys32\\ISXD.exe"	ISXD.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Sys32\AKV.exe	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe
File opened for modification	C:\Windows\SysWOW64\Sys32	ISXD.exe
File created	C:\Windows\SysWOW64\Sys32\ISXD.001	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe
File created	C:\Windows\SysWOW64\Sys32\ISXD.006	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe
File created	C:\Windows\SysWOW64\Sys32\ISXD.007	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe
File created	C:\Windows\SysWOW64\Sys32\ISXD.exe	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ISXD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_akl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
544	MicrosoftEdgeUpdate.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a000000023d1c-21.dat	nsis_installer_1

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	948	ISXD.exe
Token: SeIncBasePriorityPrivilege	948	ISXD.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
948	ISXD.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
948	ISXD.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
948	ISXD.exe
948	ISXD.exe
948	ISXD.exe
948	ISXD.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 948	1904	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe	86
PID 1904 wrote to memory of 948	1904	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe	86
PID 1904 wrote to memory of 948	1904	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe	86
PID 1904 wrote to memory of 2040	1904	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe	87
PID 1904 wrote to memory of 2040	1904	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe	87
PID 1904 wrote to memory of 2040	1904	JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f3ac8fc094262583378913a5fab26475.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\Sys32\ISXD.exe
  "C:\Windows\system32\Sys32\ISXD.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:948
- C:\Users\Admin\AppData\Local\Temp\setup_akl.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_akl.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2040

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTNBRTBERkEtOTVFRi00QkQyLUJCNTktREVCQUM5RjlDMDA5fSIgdXNlcmlkPSJ7QzU1QjQzRkEtQjczQS00NDJCLUI4ODItRDBCMzEwNTE5QzBFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MThCOUYyMTUtMDhGOC00Q0JCLThFMUEtRTBENkYwRDRFN0FGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTAyNDQ1NzY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@7BF6.tmp

Filesize
3KB

MD5
e6d3a1562e0a2d9230e4bfd7e477dffd

SHA1
ef5d510e60caef4924eced60c092a63e9233b375

SHA256
49ee7df841542ff4fc5232bd8244f06683cc70f8af5f861b94497b504208b3ab

SHA512
e6d866daf96ad912d4ad69324d9f89820d15dd2a8d34aba5b3392aa5f6a67931f988080a25fa09067f81024180a3a4c0e211a80405b56e6663481fce7ffa1177

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_akl.exe

Filesize
416KB

MD5
5cdd8bea2cbbedd5a41eb9dc8c0776e4

SHA1
9b7a1487033f3be915de18e14b2152cb52be71c9

SHA256
f43962fb4dd9cfc395a6af929c4c09166faa6eb62835f7df841ea69a18936b10

SHA512
3359f94b33f36060d73b91519e24f277255587d5e7477b670dab0aa376831589b7d8c56358e204c3c3c106eb43f00212204757e1d7e42b481fd4d702a9a84662

Download Submit
C:\Windows\SysWOW64\Sys32\AKV.exe

Filesize
389KB

MD5
f567d932480c03ab1de08b1b72aada97

SHA1
92c60c8971cf6aa88baf945c61c3a40709c03e02

SHA256
565e67c1959c0dec7be32b308681ec7106cde58b1b409cc21cbc642b7a6d627f

SHA512
2c9bac11470c2ff211054df00f252c312d6d2e0aea4349b03072934f8ce2623fb365c64c0eb56a08440e4daabd11799e03b158733a9922fc05ebc7782c67b3fe

Download Submit
C:\Windows\SysWOW64\Sys32\ISXD.001

Filesize
482B

MD5
ccc13aaadd91268306292d9a0c5e3773

SHA1
7d0852d59e73af176ea0059dd1739ed4c8be0c08

SHA256
abd92c99c143f11524a7b37b10318d820d412a067174677a75a3e453da59234b

SHA512
95332653bff68f8101575d2320e2bf0f54bbb1ab1bb420f14d1e4d68cd23327e4c9674da1d60b745886e2a9cf6b0b44e2a920838a48c41028528cefd437879c0

Download Submit
C:\Windows\SysWOW64\Sys32\ISXD.006

Filesize
7KB

MD5
02d9f210aac7049c13f026ba9898a9bd

SHA1
b6aae5e7fae29934042af5f6a6d51a52b51265a1

SHA256
43b9f2d721ec6e419b865639dead7ba29202839f967ba172f479977db8ea4e9b

SHA512
dda86da60ab27f2c05ebd8e7d4b709771da0edb22ba406336898e4e7e5c2febbfe9d81fb946d6440f6393e0f8c25ae61125e4ff3e8aa168c1e36a63e89999466

Download Submit
C:\Windows\SysWOW64\Sys32\ISXD.007

Filesize
5KB

MD5
5b9bf404722eac0ff29f1609f4e938ac

SHA1
4a0dc9cf5f7cb6855b4f2745646c4a3dcf995ba2

SHA256
45e39c6673b2e580e6cc01f2213dcc4d93da2eb561c94066506d90ceea8c3522

SHA512
50b6689db1e052d39ee1abf3ddab19b64f99ba48460fa75abf5e467d79d99958aa0a9524f3ad0d91d48cfd429ed09cfca068446287d8373974b7583eafc0fd29

Download Submit
C:\Windows\SysWOW64\Sys32\ISXD.exe

Filesize
475KB

MD5
d0c5feb812ca765b00a3ca0e974fabd2

SHA1
c5a4b5aee6b92019552f811d3ceb4fdcee0105fa

SHA256
cd2de8b54a5de630e03177a736a35f85a1f8d8367a392ed833fb6fee29c96440

SHA512
fb4e5bda23453484f0d0c4cc3bdc1f29a36be56281f558f356b579996bde15290a9dfbbc018ffe86e2304832a2898710f0331b7f3cd181d16930e2abbdfaafe8

Download Submit
memory/948-30-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/948-34-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads