Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
04-07-2023 15:00
Behavioral task
behavioral1
Sample
easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe
Resource
win10v2004-20230621-en
General
-
Target
easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe
-
Size
1013KB
-
MD5
20ccff9fe7e559f00672bb32f5f05dd6
-
SHA1
9f57ec4334cf336853ddbfba912ed3b32d05a69e
-
SHA256
cf84b3618117d23efa8f6bdb0b7934c6d920e52723580c44866fdaf31148f75e
-
SHA512
50eee511d87b2e091e9b8e1cd87bce1fd6805b73ea3b9c8c25876f6afae275564aa535ce7de2db0976c88fea02d09f4732eac3929b6077cbf51e4494334c8680
-
SSDEEP
24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxV:7J5gEKNikf3hBfUiWxV
Malware Config
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\budha.exe family_ammyyadmin C:\Users\Admin\AppData\Local\Temp\budha.exe family_ammyyadmin C:\Users\Admin\AppData\Local\Temp\budha.exe family_ammyyadmin -
Executes dropped EXE 1 IoCs
Processes:
budha.exepid process 2300 budha.exe -
Loads dropped DLL 1 IoCs
Processes:
easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exepid process 588 easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\budha.exe upx behavioral1/memory/588-60-0x0000000000400000-0x0000000000410000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\budha.exe upx behavioral1/memory/2300-62-0x0000000000400000-0x0000000000410000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\budha.exe upx behavioral1/memory/2300-66-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exedescription pid process target process PID 588 wrote to memory of 2300 588 easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe budha.exe PID 588 wrote to memory of 2300 588 easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe budha.exe PID 588 wrote to memory of 2300 588 easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe budha.exe PID 588 wrote to memory of 2300 588 easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe budha.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe"C:\Users\Admin\AppData\Local\Temp\easy_Malicious_05d418023a1f15adc5b915976202e27bd846064b31db6fa1c04c0797df7b09f8.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\budha.exe"C:\Users\Admin\AppData\Local\Temp\budha.exe"2⤵
- Executes dropped EXE
PID:2300
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1013KB
MD5d6384e0405af55eec868fbdeda460b05
SHA143ec46a0537c040583994eb52d999285007ec772
SHA256fe44a10ef1b4f71adef53102be5dc60bdd61fdd969efd56cce5f4601af07310a
SHA5121d1c14037725bc06eb97c52e1e76d7732ca89d8d869ef34a82757edde3063ac5f82a758c54f4bf1f70a6c016a4cc4c3927be0f1c8378cf22226269a9415cc369
-
Filesize
1013KB
MD5d6384e0405af55eec868fbdeda460b05
SHA143ec46a0537c040583994eb52d999285007ec772
SHA256fe44a10ef1b4f71adef53102be5dc60bdd61fdd969efd56cce5f4601af07310a
SHA5121d1c14037725bc06eb97c52e1e76d7732ca89d8d869ef34a82757edde3063ac5f82a758c54f4bf1f70a6c016a4cc4c3927be0f1c8378cf22226269a9415cc369
-
Filesize
1013KB
MD5d6384e0405af55eec868fbdeda460b05
SHA143ec46a0537c040583994eb52d999285007ec772
SHA256fe44a10ef1b4f71adef53102be5dc60bdd61fdd969efd56cce5f4601af07310a
SHA5121d1c14037725bc06eb97c52e1e76d7732ca89d8d869ef34a82757edde3063ac5f82a758c54f4bf1f70a6c016a4cc4c3927be0f1c8378cf22226269a9415cc369