flawedammyy | e682ea6f18a526c3f0d8e7b6f3673b05e8e211a29fe3274423756d4731289224

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2023 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AA39_55.exe
Size

776KB
MD5

e3a944626a6932d5625b4e956781d8c5
SHA1

21022d5300a201433e84b18f8e4f1c94fd0904fe
SHA256

e682ea6f18a526c3f0d8e7b6f3673b05e8e211a29fe3274423756d4731289224
SHA512

d9e43d846c74a3db8bf96aa554c6216119f89d296c85ab0396c5000944ed0e6cabcf8a6b437aa22feaac56584ad1fe167f98434b6551377b400dbda0f360659c
SSDEEP

12288:KWeiVSRZI3HAaMhYBSJEKH0OERt4PMsajW0pSEVJjgjX:lHIZI3AaiYBSGKpERtMMRy0pDcjX

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AA39_55.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	AA39_55.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

AA39_55.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA39_55.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA39_55.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	AA39_55.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	AA39_55.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 53fec67daad618ec0b70e233a1174ff0ff216dbd501089a90f95d9164cd22c8df88cce9d38d863543497bce60709ff6e81abe5ce60adc490faf529de649a3bd008529505dd	AA39_55.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AA39_55.exe

pid	Process
244	AA39_55.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

AA39_55.exe

pid	Process
244	AA39_55.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

AA39_55.exe

description	pid	Process	procid_target
PID 3120 wrote to memory of 244	3120	AA39_55.exe	86
PID 3120 wrote to memory of 244	3120	AA39_55.exe	86
PID 3120 wrote to memory of 244	3120	AA39_55.exe	86

C:\Users\Admin\AppData\Local\Temp\AA39_55.exe
"C:\Users\Admin\AppData\Local\Temp\AA39_55.exe"
1⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\AA39_55.exe
"C:\Users\Admin\AppData\Local\Temp\AA39_55.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\AA39_55.exe
  "C:\Users\Admin\AppData\Local\Temp\AA39_55.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\settings3.bin

Filesize
318B

MD5
8411a75a1e371db9594e9943e3c6c850

SHA1
575abe26802724d1436d6083ff17802bc66a793c

SHA256
1a621d89ef9377869faf8c6bf1af7e6a370d12054f21ecdeb9ba266815929d10

SHA512
b83f349899a9c4a99a50120d5d55a6d4ded9373db3dbf26a24abf4e80254a1119483ec00d0fb58b13ade78a868705b5f55cfc829ffc12082a54e7111c34c1fc3

Download Submit