Analysis
-
max time kernel
191s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26/11/2022, 14:26
General
-
Target
fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe
-
Size
825KB
-
MD5
35c17c148e30f391d8e88918da3bd258
-
SHA1
962f89351e7e75d1129a797adfcd848a5342e881
-
SHA256
fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe
-
SHA512
e9708119d5f72838fe6229c29fb519a0c1c93bb7df8405db712a0b84719a5891cf48af81cf83f4ef3de17fcbe4f928c1b21fce68ae92b00d366f19203e462e00
-
SSDEEP
24576:ckK+waI8JRQMEJ2rufRtse9rkv8klBiIrgFvqIL:Z4aSlxElBiHA8
Malware Config
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 5 IoCs
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe"C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe"C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe" -service -lunch1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe"C:\Users\Admin\AppData\Local\Temp\fc15639624d4de9bb831c1e38bf403a12c9ffa00f063452360be32e6e96550fe.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76B
MD5090bba5cbe9cd62189310f633f14d686
SHA10ce1d78aace04650b0c592665686a89412c1771c
SHA2567bc48188bbd0ad1b7ac10257e6a8fc5327f2ccfd56402a4353f6d8ef26eb0ff8
SHA512846781bdb4d8902963f1859077c8db4c763fdd4ca28f0be83b95c20d324b5db030f312fc3d4f959dc05ca4f41ef872a49d123195494b16440e16ebcc5edb31a7
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
460KB
-
Filesize
652KB
-
Filesize
460KB
-
Filesize
652KB
-
Filesize
460KB
-
Filesize
652KB
-
Filesize
652KB
-
Filesize
460KB
-
Filesize
652KB
-
Filesize
460KB