ardamax | a3532ce7fae80e1fc9f32bcfecb372ff01592c77bc3b784d39d96523ad710cc6

General

Target
jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe
Size 306KB
Sample260919-st48wasemd
SHA256 a3532ce7fae80e1fc9f32bcfecb372ff01592c77bc3b784d39d96523ad710cc6
MD5 9bd9476587c6806e9d9de9db1e6bfd3d
SHA1 7a4eff283887dcd3e08a58fb87716c5ab888040c
SHA512 62a1d467ae45b45fe024006d26626b3be389d17695af85ec5ea2d70dd4836c967fb19ec589e7b75d38d81758959977e5d82c914393fbc643025a5a65b32c6155
SSDEEP 6144:HlG6CxpQCqjYdNWJO188qI1btWLLfCyWuctfQCtZzmfUMEcnrh5fACo:Hloxl0YOJO1HbcrStfjtEfFIv
TLSH
T1DC6412BBB3500929E45C4F30A8624D75E7A7BC614E3E080B6FC43B4E0E7B964496667F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery ardamax keylogger persistence stealer

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.drivehq.com
Port
21
Username
firefox11

Signatures

Family: Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c40a-12.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
4136	RNTY.exe
4252	RNTY.exe

Loads dropped DLL 8 IoCs

pid	Process
4648	jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe
4136	RNTY.exe
4136	RNTY.exe
4136	RNTY.exe
4252	RNTY.exe
4252	RNTY.exe
4252	RNTY.exe
1960	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RNTY Agent = "C:\\Windows\\SysWOW64\\28463\\RNTY.exe"	RNTY.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\RNTY.009	RNTY.exe
File opened for modification	C:\Windows\SysWOW64\28463\RNTY.009	RNTY.exe
File created	C:\Windows\SysWOW64\28463\RNTY.001	jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe
File created	C:\Windows\SysWOW64\28463\RNTY.006	jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe
File created	C:\Windows\SysWOW64\28463\RNTY.007	jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe
File created	C:\Windows\SysWOW64\28463\RNTY.exe	jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe
File opened for modification	C:\Windows\SysWOW64\28463	RNTY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	4136	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RNTY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RNTY.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	4136	RNTY.exe
Token: SeIncBasePriorityPrivilege	4136	RNTY.exe
Token: SeIncBasePriorityPrivilege	4136	RNTY.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4136	RNTY.exe
4136	RNTY.exe
4136	RNTY.exe
4136	RNTY.exe
4136	RNTY.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4136	4648	jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe	89
PID 4136 wrote to memory of 3876	4136	RNTY.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9bd9476587c6806e9d9de9db1e6bfd3d.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\28463\RNTY.exe
  "C:\Windows\system32\28463\RNTY.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 1588
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\RNTY.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3876

C:\Windows\SysWOW64\28463\RNTY.exe
C:\Windows\SysWOW64\28463\RNTY.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4136 -ip 4136
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@D618.tmp

Path C:\Users\Admin\AppData\Local\Temp\@D618.tmp
Size 4KB
SHA256 f1265c88f0077009eaa18db413f156cc7ad8d41dc9d797dd1032b0e0ae9c40d5
MD5 13e10cd76f11d6cb43182dcba7370171
SHA1 e6b8ce329e49ff09f1cb529c60fc466cb9a579c8
SHA512 ee32ef3f50838936417e51dfd365b166456900e327dbe51902700bb3d562dea22e6fbd9009c822ba0562687001802a2e61d38123f81ae19f7b3d05bb1fd5cda8
TLSH
T1A781947F77E811B3C1936BB12ACD055BB755B23007A2401A8E730B071A6AC9EDC25752
MD5 SHA1 SHA512 TLSH

Submit Download

RNTY.001

Path C:\Windows\SysWOW64\28463\RNTY.001
Size 402B
SHA256 19334ee229f1f4128d1803681dc8279aaba17ac10280b09b556e736cc9b912d5
MD5 25d9df6465763daf6e282743e827bba9
SHA1 797d0c2c834f896760ca47d2f137a23409a1a5ed
SHA512 37fedf72a66ef16239ab2766546219d96e44a1cbedfef2b64caca1393576efe5d010ca759dad3a82cc025ef23cf0a73da2ea06e880a15e125b0e6445fab71127
TLSH
T15DE05E23B0D880003798F002B6E0AD32F582451E123FB1D078AB0154940F32FE0D63D0
MD5 SHA1 SHA512 TLSH

Submit Download

RNTY.006

Path C:\Windows\SysWOW64\28463\RNTY.006
Size 8KB
SHA256 ac54ebb9eec3212f294462ce012fdc42f4b0896d785d776a5a2cc3599dc5bcde
MD5 f5eff4f716427529b003207d5c953df5
SHA1 79696d6c8d67669ea690d240ef8978672e3d151c
SHA512 5a48599a5855f06c3e7d6f89c4e06bab1f4381b9d30cf3824c465b8fd6c142b316e6bd6aaad73d1f9b3e84d96113fb5e7374831bf503744013c9e1a0632a0caf
SSDEEP 192:53mZQCCw31JY58VINWkoHeDH7yD6pcb9:+yQ1JY5cbmU6p
TLSH
T171F1E832378609B2DBBA26F58897263BC26B5110A7D240F34F9319D11CA16D3FF38B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RNTY.007

Path C:\Windows\SysWOW64\28463\RNTY.007
Size 5KB
SHA256 9eada36d17635bedb85ce96a62cb019dbfee696b9986f69de7d5b5bc1f44df5d
MD5 bc75eddaa64823014fef0fe70bd34ffc
SHA1 15cd2ace3b68257faed33c78b794b2333eab7c0a
SHA512 20db25f32f9cfdbffa4f30c0065125052c6e20b7dcc147fa7ebff38e37b51f6a43e48e486f148d7ee11671479b9fb0bbe1c6df151101af3b50c65fd334d13baa
SSDEEP 48:6gklbR246wUQEEiD4rAKaKzx/aGJ5syXB/AECi1cBaVM+kHPjDouE:6gSslDEFaylx4ECiRQHPjDoz
TLSH
T165C19333F3E504B3F61B53B2659A10EB37BAB13047A2040A48D7019A2966A73CE3C763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RNTY.exe

Path C:\Windows\SysWOW64\28463\RNTY.exe
Size 473KB
SHA256 f6d9c3bba7fc4dfa681cadf68f41093e3c431501c6789e891e599719e5d2781c
MD5 3c90d45b1c004e86a7f7a7a340f1abc8
SHA1 10602c450bcbda2735dc036f2e399646f0c64f4c
SHA512 85457be4c2aa76ede288cd185131d46e5f0b37187313f3a54fe789e28929ec6e44282f4ba0981f46354705cd5da83990586c8846f52fcdb807908254c8719cc1
SSDEEP 6144:6vBA78H7sQr4Afbhba52Oj2sIREStoX2/iV2FNqxEsOAb:MA7DVAfbOCsIjodHb
TLSH
T1E4A49E0033E2C0B2D4E706B01D77A7654B79BE2117398ACBB7E46E4A7D706D1AB39352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4136-22-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/4136-30-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads