ardamax | d6b9780a8157ac26d2077ab2c0dc6023636cc3adb5e7beb60feb7704273be965

General

Target

JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe
Size

468KB
MD5

bd214a57c87f89ce4fed7ccea2b2fdba
SHA1

bac92fda8b52a577fee06311a055ead9863cf0b7
SHA256

d6b9780a8157ac26d2077ab2c0dc6023636cc3adb5e7beb60feb7704273be965
SHA512

186d2a1ae5fd053abd3bc85db68969d4a85255731822865a8e3de3fb60dcf72672e0727410db7f3754e469bf28fcd9778ce8149a11da470278c3457e863c8007
SSDEEP

12288:xJw3phAQmsiXLdkQTgVO+gpbKPB6qjdvcyPqTUsTFcq:0Z5md2QtU6cWmiWq

Score

10^/10

ardamax discovery keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024256-16.dat	family_ardamax

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe

Executes dropped EXE 2 IoCs

pid	Process
860	Install.exe
1848	tibiaauto.exe

Loads dropped DLL 4 IoCs

pid	Process
2060	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe
860	Install.exe
860	Install.exe
860	Install.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Install.001	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe
File created	C:\Windows\SysWOW64\Install.006	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe
File created	C:\Windows\SysWOW64\Install.007	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe
File created	C:\Windows\SysWOW64\Install.exe	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64	Install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tibiaauto.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	860	Install.exe
Token: SeIncBasePriorityPrivilege	860	Install.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
860	Install.exe
860	Install.exe
860	Install.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 860	2060	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe	88
PID 2060 wrote to memory of 860	2060	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe	88
PID 2060 wrote to memory of 860	2060	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe	88
PID 2060 wrote to memory of 1848	2060	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe	89
PID 2060 wrote to memory of 1848	2060	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe	89
PID 2060 wrote to memory of 1848	2060	JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd214a57c87f89ce4fed7ccea2b2fdba.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\Install.exe
  "C:\Windows\system32\Install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:860
- C:\Users\Admin\AppData\Local\Temp\tibiaauto.exe
  "C:\Users\Admin\AppData\Local\Temp\tibiaauto.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@6A43.tmp

Filesize
4KB

MD5
3a64783e94ab53902afd1ce21dc63379

SHA1
4933f4cdbd10630f0cf54952251e7d14c3ecd8ee

SHA256
ebb2b9682502e81881c647e30575c75d202d6185c7b182003c0eea8717b26dbf

SHA512
1178f0288b38b4509fca4fb1693671b2dbe4ca73cddc1679053f6680556c099691f2690c2298ea16285ad94ad8008ee1b5cebae25724d69b7dcb90ba67431e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\tibiaauto.exe

Filesize
320KB

MD5
d16e40894745029fd262872f3482a96a

SHA1
54b4a6e16efc9bbba7cdfd1f587f5a40aeb9be2e

SHA256
2524a19fde069e9caf862dbad9b61cef5496959254aa019b3b7443c5fb7c1ae1

SHA512
112fc69c8950e342523cdd4f90ec04f9964d5707c87e612fa6b7a114b81be1d39117199e40e2c49a138da7d37a9101bedee5fd6dbb736f11a5916a5b1a752ff3

Download Submit
C:\Windows\SysWOW64\Install.001

Filesize
1KB

MD5
57db3ea159c5a8a45cb169e882d1079c

SHA1
32aa8769ea68191ffbf672b6e09c72096cd3cd65

SHA256
1a8c8bb1cf69e4de8e47d1ade0f72fdffe90bf72428e3b7d0e034f2e0a08352f

SHA512
906c9601e828f8e02d25445f18cdc21f91e92321265b7177905621e8755872e014729c78bd4a603b92da2c9533c090591a88956ec5e7a38310f6f3bda44f3d1c

Download Submit
C:\Windows\SysWOW64\Install.006

Filesize
4KB

MD5
82dcd329190d327df8cc558ddb7bd796

SHA1
60692ef3d251e4be19445f3c37acaabd43e5153a

SHA256
88930ac9efc89f62bf2d9c7d967956591fa1f3ee886cabe799c41d252647285d

SHA512
76b094cf5baefe39d478445dcd5f3fbaa5ccca80abe9774c5aa9cf852cea5da37d052190968bb6f41cbd9cc6865a6b85492b4a606ac4607ac07c7f14be149d5a

Download Submit
C:\Windows\SysWOW64\Install.007

Filesize
6KB

MD5
d82e272edfbadabf6f82fc5018ce97fc

SHA1
88beb0c2463678910d4c726e1207ec08d7f3b00f

SHA256
604434efc6c026f83708a5473aa993775649d69828315b8eafd33b58999292cd

SHA512
8663a9900b4ab8912d1aeec930e0a088bb90a46a7c575f62a9f8f7d1dc4bdfec9ffffe9ea71f5d00125b3e113864cffdee4632352d17c36f73d8bc571733231d

Download Submit
C:\Windows\SysWOW64\Install.exe

Filesize
244KB

MD5
1cc2de0847d50813932844efcd3eac9c

SHA1
78799db1a7e289503fe4160d16c487fb8d45db74

SHA256
d2b114a49c9941d0888d0e215f1e1b00949271877d247421c0fa85f8e7c3261b

SHA512
b66cb6c931b1d541579f9c4f5ad3ee71b7ef884bf5ede2a77e8120356813f5aab8790cbced26671cc4ba77383196660ac51496a221d80ecb984ed2931c093c1c

Download Submit

Analysis

Sharing