Analysis Overview
SHA256
be9431058a7e773c7012df0a7c24653932d0ea1eac0daa9a7b8e4192dfc45d3e
Threat Level: No (potentially) malicious behavior was detected
The file budha.exe was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
AmmyyAdmin Payload
Ammyyadmin family
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2021-09-16 13:32
Signatures
AmmyyAdmin Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Ammyyadmin family
Analysis: behavioral1
Detonation Overview
Submitted
2021-07-26 18:55
Reported
2021-07-26 18:58
Platform
win7v20210410
Max time kernel
148s
Max time network
174s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\budha.exe
"C:\Users\Admin\AppData\Local\Temp\budha.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | maitikio.com | udp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| US | 8.8.8.8:53 | cry-havok.org | udp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
Files
memory/1700-60-0x0000000075011000-0x0000000075013000-memory.dmp
memory/1700-62-0x0000000002760000-0x0000000002B60000-memory.dmp
memory/1700-61-0x0000000001F70000-0x0000000001F71000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2021-07-26 18:55
Reported
2021-07-26 18:58
Platform
win10v20210408
Max time kernel
138s
Max time network
150s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\budha.exe
"C:\Users\Admin\AppData\Local\Temp\budha.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | maitikio.com | udp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| US | 8.8.8.8:53 | cry-havok.org | udp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| US | 8.8.8.8:53 | cry-havok.org | udp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
| US | 8.8.8.8:53 | cry-havok.org | udp |
| BE | 35.205.61.67:443 | maitikio.com | tcp |
Files
memory/672-114-0x0000000002230000-0x0000000002231000-memory.dmp
memory/672-115-0x0000000002770000-0x0000000002B70000-memory.dmp