Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2023 15:04
Behavioral task
behavioral1
Sample
easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exe
Resource
win10v2004-20230703-en
General
-
Target
easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exe
-
Size
975KB
-
MD5
0b35a4c01a9f482505d6c8dc4f8a8267
-
SHA1
d9946541f50c33b11c119ba4f8cbfc2a2cb49146
-
SHA256
7d63cac8bc83fb31807b5446b8aa210ad532b608cbf09f1dfc580008b33281b8
-
SHA512
f5fcf4b29b3cf9524a4795654ad0bb016caea5e9f4f05e878c6eb5c4cacae625c0d75e012022f3db1f53d12e30434e00700cebc483328a16fdeaf5127e17d90f
-
SSDEEP
24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxy:7J5gEKNikf3hBfUiWxy
Malware Config
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\budha.exe family_ammyyadmin C:\Users\Admin\AppData\Local\Temp\budha.exe family_ammyyadmin C:\Users\Admin\AppData\Local\Temp\budha.exe family_ammyyadmin -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exe -
Executes dropped EXE 1 IoCs
Processes:
budha.exepid process 2664 budha.exe -
Processes:
resource yara_rule behavioral2/memory/1460-133-0x0000000000400000-0x0000000000410000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\budha.exe upx C:\Users\Admin\AppData\Local\Temp\budha.exe upx C:\Users\Admin\AppData\Local\Temp\budha.exe upx behavioral2/memory/1460-142-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2664-144-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exedescription pid process target process PID 1460 wrote to memory of 2664 1460 easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exe budha.exe PID 1460 wrote to memory of 2664 1460 easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exe budha.exe PID 1460 wrote to memory of 2664 1460 easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exe budha.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exe"C:\Users\Admin\AppData\Local\Temp\easy_Malicious_29df40b3ae825c4e187493553ae9f9111f26229851d04fcd0e62808dbbf1f22e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\budha.exe"C:\Users\Admin\AppData\Local\Temp\budha.exe"2⤵
- Executes dropped EXE
PID:2664
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
976KB
MD5b7d9b263f07142c9e3579573f49702e0
SHA180ef25db597a889397e3683a389742098d4be83a
SHA2564e50a84f0c8fd31d1e8306167d0d8895e2d9b6c414a51af0d39fb8235f182010
SHA51227c3b227f155d60abc1423c84379b65fff5862ff417a09a6ca37fe6557a3d9d3f4e68ffa5ff8fa098dd868d5e537c64c872b9a764f9f41e36a2082a04d6a76f9
-
Filesize
976KB
MD5b7d9b263f07142c9e3579573f49702e0
SHA180ef25db597a889397e3683a389742098d4be83a
SHA2564e50a84f0c8fd31d1e8306167d0d8895e2d9b6c414a51af0d39fb8235f182010
SHA51227c3b227f155d60abc1423c84379b65fff5862ff417a09a6ca37fe6557a3d9d3f4e68ffa5ff8fa098dd868d5e537c64c872b9a764f9f41e36a2082a04d6a76f9
-
Filesize
976KB
MD5b7d9b263f07142c9e3579573f49702e0
SHA180ef25db597a889397e3683a389742098d4be83a
SHA2564e50a84f0c8fd31d1e8306167d0d8895e2d9b6c414a51af0d39fb8235f182010
SHA51227c3b227f155d60abc1423c84379b65fff5862ff417a09a6ca37fe6557a3d9d3f4e68ffa5ff8fa098dd868d5e537c64c872b9a764f9f41e36a2082a04d6a76f9