Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-07-2023 06:27

General

  • Target

    Device/HarddiskVolume2/Rahman/Discoverer/Softwares/Remote connection softwares/AA_v3.5.exe

  • Size

    746KB

  • MD5

    2cbf5657ffd8858a9597f296a60270c2

  • SHA1

    b130611c92788337c4f6bb9e9454ff06eb409166

  • SHA256

    9b3f4d6a9bae4d7f9cfe45e706db8fe4baef51ae12353941e8b1532b231e6eac

  • SHA512

    06339a299c8c9ce55e9b96582e54e0bf9e04f894ceb47c07486adf8b0140c2a01fd0932207aca8112ee0b16ba8711fee9435e37339aafb94f167b5a736ee7d0b

  • SSDEEP

    12288:6NgEvTkYGzXUMA7PTgM0YOg26y4RtcxcUwhqb3omaY80NP6gL:6XTszE7PTgM0YOgA4RtcbwhsSYFVL

Score
10/10

Malware Config

Signatures

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Drops file in System32 directory 4 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe
    "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"
    1⤵
      PID:1560
    • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe
      "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe" -service -lunch
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1032
      • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe
        "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"
        2⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1052

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\AMMYY\hr

      Filesize

      22B

      MD5

      090ef684fd862129820caf4f835acadf

      SHA1

      d0bb3c614b4752b47ce1ecd108b8b768c7e25764

      SHA256

      c16e2f0f7b6a3549ec5a030233b90a9498cd024848c614d1ada64097ad045413

      SHA512

      c91aff90336594a2c828ad007f9f2b5ab16e5169541223a4472504df4262e263346bce27e99421198051dd635d550e7615ce52cdcb47cfd2463e16d7cdf579b5

    • C:\ProgramData\AMMYY\hr3

      Filesize

      68B

      MD5

      88b35de577f5303da8c4fcc0297554cb

      SHA1

      45396717f04b9a52a69896cbdea671041da70f02

      SHA256

      4de477963e7c285c5753f812d03fbe95b9c90623cea99f37b7372ffd4c7da1e2

      SHA512

      6f78a10c6e5d631c83ced53eecb609e12a3b0c852e61082454396b63c51a8bddcfb0903a2388394f797bb1bd3fb570e0a01c6bc83f35d95da21318c510fd0e23

    • C:\ProgramData\AMMYY\settings3.bin

      Filesize

      271B

      MD5

      714f2508d4227f74b6adacfef73815d8

      SHA1

      a35c8a796e4453c0c09d011284b806d25bdad04c

      SHA256

      a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

      SHA512

      1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8