flawedammyy | 03201982c09f0b8d7e4fb849a882277521e55b6b52e1562c6d19252b9635e09b

General

Target

cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Size

32.7MB
MD5

3c62d59ddaf151bd4080821d415a08ef
SHA1

70129d7eb37c361aa1f6077fda3b76b6b3bb7f62
SHA256

cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad
SHA512

fee1784e9ce231cd8b13c2caf19c08984934e7f2d236fd5f697d52dcbbddd251f0d87315ade07277fa294c62ced8ae6173c62b557c7dab79603f451970f09938
SSDEEP

12288:Gii1SQxjP6j34G+t2aPHXuTy4RtfUwFDZAQmsNs8wsP6g:O1S6z6j34G+t2afXh4RtxFD/mAsV4

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

Processes:

cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = a2e8b074c8e70be3b522ade214765359642bb41ecfc7e26bdc1513874da7b621c7dc3f9b67d26a5f50e6bd9d7434dd6dc3878add096332114ab5e0e1e71b0a5b1d24f0b8	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e155253fa220c904253b26b	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

pid process

180 cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

pid process

180 cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

pid	process
180	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

pid	process
180	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

description	pid	process	target process
PID 4544 wrote to memory of 180	4544	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
PID 4544 wrote to memory of 180	4544	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
PID 4544 wrote to memory of 180	4544	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe	cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe

C:\Users\Admin\AppData\Local\Temp\cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
"C:\Users\Admin\AppData\Local\Temp\cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe"
1⤵
PID:2880

C:\Users\Admin\AppData\Local\Temp\cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
"C:\Users\Admin\AppData\Local\Temp\cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:4544

C:\Users\Admin\AppData\Local\Temp\cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe
"C:\Users\Admin\AppData\Local\Temp\cb08d5622b147d7c13ddea2da4462af62030a473e48188f1e0bfd5d7480fbfad.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
aebb964c3cd9573a043196bb2dd56466

SHA1
f4e807daca45ecd6840fdae90cd25a4640942d39

SHA256
b0b58546206224124426cd4a5bfbcfb99bcc11120fe34149583d1b20e81988fe

SHA512
ddd86d67e703c296cbf30a7909dba363098b7710f39bddbb5615a480fed0898f422bec641d7da43df76115c7ca5c28e4fc1d6dfb990e0638aeafea5f50d29f4e

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
5ba93ce2ddb0c34aa434a4bb69430fc8

SHA1
da4d026eadeb951aed931a500111e87db27eb360

SHA256
35d45488adc14976fe4e2ac8e4399bb166da01b13b6ee6fce20d94f33e759d18

SHA512
5aa7bb06eaa79f6525fa254e6d1e9a7edd66c15253cbf060e86c1e0075e2117d0a918dc541e5cf05a5bdc786702fc72cba7d762f9249421e57301ed897893917

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
714f2508d4227f74b6adacfef73815d8

SHA1
a35c8a796e4453c0c09d011284b806d25bdad04c

SHA256
a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

SHA512
1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads