Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2023 06:27
Behavioral task
behavioral1
Sample
Device/HarddiskVolume2/Rahman/Discoverer/Softwares/Remote connection softwares/AA_v3.5.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume2/Rahman/Discoverer/Softwares/Remote connection softwares/AA_v3.5.exe
Resource
win10v2004-20230621-en
General
-
Target
Device/HarddiskVolume2/Rahman/Discoverer/Softwares/Remote connection softwares/AA_v3.5.exe
-
Size
746KB
-
MD5
2cbf5657ffd8858a9597f296a60270c2
-
SHA1
b130611c92788337c4f6bb9e9454ff06eb409166
-
SHA256
9b3f4d6a9bae4d7f9cfe45e706db8fe4baef51ae12353941e8b1532b231e6eac
-
SHA512
06339a299c8c9ce55e9b96582e54e0bf9e04f894ceb47c07486adf8b0140c2a01fd0932207aca8112ee0b16ba8711fee9435e37339aafb94f167b5a736ee7d0b
-
SSDEEP
12288:6NgEvTkYGzXUMA7PTgM0YOg26y4RtcxcUwhqb3omaY80NP6gL:6XTszE7PTgM0YOgA4RtcbwhsSYFVL
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Drops file in System32 directory 4 IoCs
Processes:
AA_v3.5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 AA_v3.5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE AA_v3.5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies AA_v3.5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 AA_v3.5.exe -
Modifies data under HKEY_USERS 9 IoCs
Processes:
AA_v3.5.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix AA_v3.5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" AA_v3.5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin AA_v3.5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy AA_v3.5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e15525351ad9d4c3ff2b16b AA_v3.5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" AA_v3.5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE AA_v3.5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin AA_v3.5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 2de8d209c8dd70ff541e03acc1eece1d499979d93548908ab1847129e8dc1c1e3b6aeac05ae8f023fe7ddf8a2801e49a9a963cf1f45fa85acb3371c80a9e702f0a409e45 AA_v3.5.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AA_v3.5.exepid process 1052 AA_v3.5.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
AA_v3.5.exepid process 1052 AA_v3.5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
AA_v3.5.exedescription pid process target process PID 1032 wrote to memory of 1052 1032 AA_v3.5.exe AA_v3.5.exe PID 1032 wrote to memory of 1052 1032 AA_v3.5.exe AA_v3.5.exe PID 1032 wrote to memory of 1052 1032 AA_v3.5.exe AA_v3.5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"1⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe" -service -lunch1⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1052
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD5090ef684fd862129820caf4f835acadf
SHA1d0bb3c614b4752b47ce1ecd108b8b768c7e25764
SHA256c16e2f0f7b6a3549ec5a030233b90a9498cd024848c614d1ada64097ad045413
SHA512c91aff90336594a2c828ad007f9f2b5ab16e5169541223a4472504df4262e263346bce27e99421198051dd635d550e7615ce52cdcb47cfd2463e16d7cdf579b5
-
Filesize
68B
MD588b35de577f5303da8c4fcc0297554cb
SHA145396717f04b9a52a69896cbdea671041da70f02
SHA2564de477963e7c285c5753f812d03fbe95b9c90623cea99f37b7372ffd4c7da1e2
SHA5126f78a10c6e5d631c83ced53eecb609e12a3b0c852e61082454396b63c51a8bddcfb0903a2388394f797bb1bd3fb570e0a01c6bc83f35d95da21318c510fd0e23
-
Filesize
271B
MD5714f2508d4227f74b6adacfef73815d8
SHA1a35c8a796e4453c0c09d011284b806d25bdad04c
SHA256a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480
SHA5121171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8