flawedammyy | 543eec567ecb98ca50fa8c86d9fe67cfdb318ecbc7630d1d0a3dc12ae665bb82

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2023 13:59

Target

cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe
Size

772KB
MD5

8c63956cfb2265c8e59b68dd5b2d06f8
SHA1

7424d7489a1b112f3fbd1e8342517a02aa219fea
SHA256

cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a
SHA512

66d48a9e2b3f3441879567b1fbbbd48782a8bb269b223db0f14e59afea9feebfb376baa6c52447681af677d9cd2866a8805885e0bce327d0a97d760d15754f5f
SSDEEP

12288:3SX+EvrCA3FNIs34Zk1L1ZSNlm3Spsal6lbRtMuStGKcsCSqcl90VaHg+x:gFNN4Zk1LTclm3e1kbRtyGKcpHcl5A+x

Score

10^/10

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe

description	pid	process	target process
PID 1816 wrote to memory of 3940	1816	cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe	cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe
PID 1816 wrote to memory of 3940	1816	cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe	cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe
PID 1816 wrote to memory of 3940	1816	cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe	cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe

C:\Users\Admin\AppData\Local\Temp\cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe
"C:\Users\Admin\AppData\Local\Temp\cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe"
1⤵
PID:3804

C:\Users\Admin\AppData\Local\Temp\cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe
"C:\Users\Admin\AppData\Local\Temp\cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Users\Admin\AppData\Local\Temp\cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe
"C:\Users\Admin\AppData\Local\Temp\cf00c34acedfc3cccbf909e6b68e826b1cfa9b9850781d9a421fac371588c42a.exe"
2⤵
PID:3940

C:\ProgramData\AMMYY\settings3.bin

Filesize
318B

MD5
45b9d2549c32d3a2aa42514ede2dd8dd

SHA1
6d1611cf4e44a11800d5cc9a8bab7597783a7ce6

SHA256
b0efd10625be27ef4fdf600eb6b6310b704404103baa06e497b4172215bb7b7d

SHA512
5ad7079f0449469356613f72a03be400204c4776c7a701feb1ae2276516ebfb0ed42aa11915ed3e23841408aab783eae8cb81fd5d7ae526a7c07314b9a9cd64e

Download Submit