ardamax | 85d1b250a5232848a4cd68f7ad7c4f6e870fa481c066131d1fcb500d4d8e841a

General

Target

JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe
Size

2.0MB
MD5

0a1f6ee1109d2a9f496a17a8c83ab03b
SHA1

5cfafb0faf1aa2eb2723c4dba6befe10b0ab51e2
SHA256

85d1b250a5232848a4cd68f7ad7c4f6e870fa481c066131d1fcb500d4d8e841a
SHA512

7bfe2e0bee9f714ccabba563fc87198b0ac9138fb22b483e99656241a375dfa744622a934997b9f3fd40252c9c87f5219085a0bcbf60f20dd12477b4df05a661
SSDEEP

49152:BA4pmIrkvvDca7DiwCNwIn7mWrNAlYuMsAl5ElULOvCd2Pca:y4pmlVgNwEmW5ngl9vCd2P

Score

10^/10

ardamax defense_evasion discovery keylogger persistence stealer themida

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015d78-26.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2516	install.exe
2748	CCHC.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe

Loads dropped DLL 8 IoCs

pid	Process
2516	install.exe
2516	install.exe
2516	install.exe
2748	CCHC.exe
2748	CCHC.exe
2748	CCHC.exe
2748	CCHC.exe
2748	CCHC.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2380-0-0x0000000000400000-0x000000000075C000-memory.dmp	themida
behavioral1/memory/2380-6-0x0000000000400000-0x000000000075C000-memory.dmp	themida
behavioral1/memory/2380-12-0x0000000000400000-0x000000000075C000-memory.dmp	themida
behavioral1/memory/2380-35-0x0000000000400000-0x000000000075C000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CCHC Agent = "C:\\Windows\\SysWOW64\\28463\\CCHC.exe"	CCHC.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\CCHC.001	install.exe
File created	C:\Windows\SysWOW64\28463\CCHC.006	install.exe
File created	C:\Windows\SysWOW64\28463\CCHC.007	install.exe
File created	C:\Windows\SysWOW64\28463\CCHC.exe	install.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	install.exe
File opened for modification	C:\Windows\SysWOW64\28463	CCHC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\install.exe	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCHC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2380	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2748	CCHC.exe
Token: SeIncBasePriorityPrivilege	2748	CCHC.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2748	CCHC.exe
2748	CCHC.exe
2748	CCHC.exe
2748	CCHC.exe
2748	CCHC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2516	2380	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe	30
PID 2380 wrote to memory of 2516	2380	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe	30
PID 2380 wrote to memory of 2516	2380	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe	30
PID 2380 wrote to memory of 2516	2380	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe	30
PID 2380 wrote to memory of 2516	2380	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe	30
PID 2380 wrote to memory of 2516	2380	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe	30
PID 2380 wrote to memory of 2516	2380	JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe	30
PID 2516 wrote to memory of 2748	2516	install.exe	31
PID 2516 wrote to memory of 2748	2516	install.exe	31
PID 2516 wrote to memory of 2748	2516	install.exe	31
PID 2516 wrote to memory of 2748	2516	install.exe	31
PID 2516 wrote to memory of 2748	2516	install.exe	31
PID 2516 wrote to memory of 2748	2516	install.exe	31
PID 2516 wrote to memory of 2748	2516	install.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a1f6ee1109d2a9f496a17a8c83ab03b.exe"
1⤵
- Identifies Wine through registry keys
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\install.exe
  "C:\Windows\install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\28463\CCHC.exe
    "C:\Windows\system32\28463\CCHC.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\28463\AKV.exe

Filesize
393KB

MD5
b0b09699ea39c0107af1c0833f07c054

SHA1
b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1

SHA256
be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1

SHA512
55430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796

Download Submit
C:\Windows\SysWOW64\28463\CCHC.001

Filesize
488B

MD5
ea9c6bcc471887d78c1038d47c52b415

SHA1
2ec6f9c989141364f98ca5a0d4c4907f37e6d03c

SHA256
7e30a7e70bee935ec78815537460799048cb297a39313bde0b5f0d1c8cfbab0a

SHA512
dd6f0eb267cc98f6205cc822bde673bfa0b48c1684eb647d20f0dce209242ca22f15439abad7fc61ecce9a6a750d6ec0693d381ab8ad38b9707795b3b753118f

Download Submit
C:\Windows\SysWOW64\28463\CCHC.006

Filesize
7KB

MD5
e0fcfa7cad88d1a8a462cee6b06cf668

SHA1
a7e49078517abc929a6da261df06556c8f5a8cf0

SHA256
340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

SHA512
430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

Download Submit
C:\Windows\SysWOW64\28463\CCHC.007

Filesize
5KB

MD5
ca72cd485d116033f1b776903ce7ee0a

SHA1
85b0b73a75b0498f56200dd1a5cf0de5371e42a3

SHA256
e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

SHA512
8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

Download Submit
C:\Windows\SysWOW64\28463\CCHC.exe

Filesize
472KB

MD5
346114aaad81ab66017869909fe59a6d

SHA1
770bdb6baa0d840485415da164020dead9336e27

SHA256
766b515e04dc1894e3c7108bdc9e6e9a80652ebdf717fbb27b628fb5ec0ca056

SHA512
b7bda8c0cea75fa9bde56d314e2a61b414fabde7df402cd5892dd149769f477209fcbfb7d05727952da4442e7a43578d1399f220f9d41f8b8cc9f4cd6d5ff954

Download Submit
C:\Windows\install.exe

Filesize
480KB

MD5
80659997c53b51d4b255b5c7ab7a5e3a

SHA1
cdd84ffac3d5809f0646aae4af8f06ea8e0d5530

SHA256
3aea88d830f52f58b363ef90334ac96e24a6408c1d735d24d42a9425067d4aa2

SHA512
b4671aae22b1f7f677f86d343bd67ea5347d177ddc2f756c5b3e97d5699f90c4d4578e848f4c76b5c2d29e7023c60b8bd975343e458a99fab6dcbb1ffe2eea78

Download Submit
\Users\Admin\AppData\Local\Temp\@B98F.tmp

Filesize
4KB

MD5
908f7f4b0cf93759447afca95cd84aa6

SHA1
d1903a49b211bcb4a460904019ee7441420aa961

SHA256
3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

SHA512
958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

Download Submit
memory/2380-12-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2380-2-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2380-35-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2380-6-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2380-4-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2380-0-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2380-1-0x0000000000950000-0x0000000000A45000-memory.dmp

Filesize
980KB

Download
memory/2380-43-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads