ammyyadmin | a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8

Analysis

Target

a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8.exe
Size

1001KB
MD5

a0063f8960f976b6a56ce2831b34ae19
SHA1

bafde121d67f8359ddebaf5c13ab86eceb6dccc7
SHA256

a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8
SHA512

f79fd079ce9a43e3e36e3e1ee12ca06d17ad00e6624d2d22a67bee0d615cdb447b1e12aa074d57bbc4ba9558558c670c3d0421b1aa0cd468686616861717ef6b

Score

10^/10

ammyyadmin rat

AmmyyAdmin Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\budha.exe	family_ammyyadmin
C:\Users\Admin\AppData\Local\Temp\budha.exe	family_ammyyadmin

Executes dropped EXE 1 IoCs

Processes:

budha.exe

pid process

2628 budha.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2628	budha.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8.exe

description	pid	process	target process
PID 4000 wrote to memory of 2628	4000	a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8.exe	budha.exe
PID 4000 wrote to memory of 2628	4000	a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8.exe	budha.exe
PID 4000 wrote to memory of 2628	4000	a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8.exe	budha.exe

C:\Users\Admin\AppData\Local\Temp\a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8.exe
"C:\Users\Admin\AppData\Local\Temp\a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2628

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\budha.exe

MD5
ae9bf34c3d5342386729bdef459a271b

SHA1
0663c60b0ab1149dc79517917cda8f26803f289d

SHA256
074e47886359301c80d6e73ade27a14fa65f58dde03825bc70cc8a3a3dcdca4a

SHA512
bf3ba85927c343c313acd1cba28ffb6ee8d99a6e445ebd23a9f1984453d0d70e69b262c06ebc42c422389612ef262b76d3a62688a03553af34364863085da1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\budha.exe

MD5
ae9bf34c3d5342386729bdef459a271b

SHA1
0663c60b0ab1149dc79517917cda8f26803f289d

SHA256
074e47886359301c80d6e73ade27a14fa65f58dde03825bc70cc8a3a3dcdca4a

SHA512
bf3ba85927c343c313acd1cba28ffb6ee8d99a6e445ebd23a9f1984453d0d70e69b262c06ebc42c422389612ef262b76d3a62688a03553af34364863085da1bb

Download Submit
memory/2628-115-0x0000000000000000-mapping.dmp

Download
memory/2628-120-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/2628-121-0x00000000025A0000-0x00000000029A0000-memory.dmp

Filesize
4.0MB

Download
memory/4000-118-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/4000-119-0x0000000002620000-0x0000000002A20000-memory.dmp

Filesize
4.0MB

Download