flawedammyy | e682ea6f18a526c3f0d8e7b6f3673b05e8e211a29fe3274423756d4731289224

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/05/2023, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AA39_55.exe
Size

776KB
MD5

e3a944626a6932d5625b4e956781d8c5
SHA1

21022d5300a201433e84b18f8e4f1c94fd0904fe
SHA256

e682ea6f18a526c3f0d8e7b6f3673b05e8e211a29fe3274423756d4731289224
SHA512

d9e43d846c74a3db8bf96aa554c6216119f89d296c85ab0396c5000944ed0e6cabcf8a6b437aa22feaac56584ad1fe167f98434b6551377b400dbda0f360659c
SSDEEP

12288:KWeiVSRZI3HAaMhYBSJEKH0OERt4PMsajW0pSEVJjgjX:lHIZI3AaiYBSGKpERtMMRy0pDcjX

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Control Panel\International\Geo\Nation	AA39_55.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	AA39_55.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = bb13a9a14b71e50892062290c479c1361b2ad600573e70a87cdc59c900fa6ea6536b0a919e684e4dee916a91e498e7c7ff6e56f83cf0ea6dff088eb61bab900956381a1030	AA39_55.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	AA39_55.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA39_55.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA39_55.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	AA39_55.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1760	AA39_55.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1760	620	AA39_55.exe	29
PID 620 wrote to memory of 1760	620	AA39_55.exe	29
PID 620 wrote to memory of 1760	620	AA39_55.exe	29
PID 620 wrote to memory of 1760	620	AA39_55.exe	29

C:\Users\Admin\AppData\Local\Temp\AA39_55.exe
"C:\Users\Admin\AppData\Local\Temp\AA39_55.exe"
1⤵
PID:1096

C:\Users\Admin\AppData\Local\Temp\AA39_55.exe
"C:\Users\Admin\AppData\Local\Temp\AA39_55.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Users\Admin\AppData\Local\Temp\AA39_55.exe
  "C:\Users\Admin\AppData\Local\Temp\AA39_55.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\settings3.bin

Filesize
318B

MD5
8411a75a1e371db9594e9943e3c6c850

SHA1
575abe26802724d1436d6083ff17802bc66a793c

SHA256
1a621d89ef9377869faf8c6bf1af7e6a370d12054f21ecdeb9ba266815929d10

SHA512
b83f349899a9c4a99a50120d5d55a6d4ded9373db3dbf26a24abf4e80254a1119483ec00d0fb58b13ade78a868705b5f55cfc829ffc12082a54e7111c34c1fc3

Download Submit