Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
03-07-2023 06:27
Behavioral task
behavioral1
Sample
Device/HarddiskVolume2/Rahman/Discoverer/Softwares/Remote connection softwares/AA_v3.5.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume2/Rahman/Discoverer/Softwares/Remote connection softwares/AA_v3.5.exe
Resource
win10v2004-20230621-en
General
-
Target
Device/HarddiskVolume2/Rahman/Discoverer/Softwares/Remote connection softwares/AA_v3.5.exe
-
Size
746KB
-
MD5
2cbf5657ffd8858a9597f296a60270c2
-
SHA1
b130611c92788337c4f6bb9e9454ff06eb409166
-
SHA256
9b3f4d6a9bae4d7f9cfe45e706db8fe4baef51ae12353941e8b1532b231e6eac
-
SHA512
06339a299c8c9ce55e9b96582e54e0bf9e04f894ceb47c07486adf8b0140c2a01fd0932207aca8112ee0b16ba8711fee9435e37339aafb94f167b5a736ee7d0b
-
SSDEEP
12288:6NgEvTkYGzXUMA7PTgM0YOg26y4RtcxcUwhqb3omaY80NP6gL:6XTszE7PTgM0YOgA4RtcbwhsSYFVL
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AA_v3.5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3950455397-3229124517-1686476975-1000\Control Panel\International\Geo\Nation AA_v3.5.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
AA_v3.5.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings AA_v3.5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin AA_v3.5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE AA_v3.5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy AA_v3.5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c105953e78c004f3ff2b16b AA_v3.5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 90e07713fac65a5b225592a3103972d85b8ded855010a6ba3e2580502f349dee30a3ae0c05f0ee58ea4d551cc2419acfe0e030713784f075399fabcc063858c10801a610 AA_v3.5.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AA_v3.5.exepid process 928 AA_v3.5.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
AA_v3.5.exepid process 928 AA_v3.5.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
AA_v3.5.exedescription pid process target process PID 920 wrote to memory of 928 920 AA_v3.5.exe AA_v3.5.exe PID 920 wrote to memory of 928 920 AA_v3.5.exe AA_v3.5.exe PID 920 wrote to memory of 928 920 AA_v3.5.exe AA_v3.5.exe PID 920 wrote to memory of 928 920 AA_v3.5.exe AA_v3.5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"1⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe" -service -lunch1⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"2⤵
- Checks computer location settings
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:928
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD5aaa83e46bf1bf64a7b6d583095562504
SHA125c13fb102ace5c91a4349baf4e0309028c8a81e
SHA256161b757ee242b2b9510b6857ac944b378b30bb96bc677ff7279f2748f756eb9b
SHA5120f4f8b2a557ed039f8e10a32f20ccc12d057701b791f374c3f55803410ff4b64d482f1976df3ab4a8fa4c201e1cb1c9d1729a463b7e85695f514ebfd52ab85c4
-
Filesize
68B
MD5767c30a2abee23fc8de6e55a0b814657
SHA18eeff64b1c208cbe94e96e87c5c2bac7df7f807d
SHA256fc3f0c326116f698258d19c59e44905d455a3df3710234b2ede401c7d83c9e81
SHA5127c5025cb0b32455461a0b5c0d51828efb59adebd7e156cce2b4c06e6b90f803459ff00ad01c38b4478bf999ef2a42406fd63590905fc85142156285784bac53b
-
Filesize
271B
MD5714f2508d4227f74b6adacfef73815d8
SHA1a35c8a796e4453c0c09d011284b806d25bdad04c
SHA256a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480
SHA5121171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8