flawedammyy | 42d60a91abadc88d18b8c2bddae09bc2b5d3f0c34759947f3990c9eb0eade31f

General

Target

b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
Size

726KB
MD5

d22d719495f23e38805bbea5df434abb
SHA1

3cfeeb974e65c0ba671d81459d2c6b694d5d4eaf
SHA256

b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20
SHA512

d87670775d222b25b329377c8d26c2a4c88ce6b1aa1d6fc004b95ad93f377fd56fb03e709b4b61b26c4fcf06fe477e42afe9f9715884ea91699548b1e4d4a4c7
SSDEEP

12288:ozJUxbtiiTHRJuEkQO7EwC2ZwFRtAdRXRryd+sq1zsgp:o9oNTHRz/O7rT6FRteRXR2IsqXp

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 0b157ecc3af6377fad22ade214765359642bb41ecfc7e26bdc1513874da7b621c7dc3f9b67d26a5f50e6bd9d7434dd6dc3878add096332114ab5e0e1e71b282ce1218b0e	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e155253a9b2517c3c7bb26b	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4292	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4292	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4292	4564	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe	89
PID 4564 wrote to memory of 4292	4564	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe	89
PID 4564 wrote to memory of 4292	4564	b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe	89

C:\Users\Admin\AppData\Local\Temp\b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
"C:\Users\Admin\AppData\Local\Temp\b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe"
1⤵
PID:3380

C:\Users\Admin\AppData\Local\Temp\b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
"C:\Users\Admin\AppData\Local\Temp\b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe
  "C:\Users\Admin\AppData\Local\Temp\b5f65158f6713aa2fb7dd0b09d5f6dd39ae3cd1212ad330da207244d522aee20.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
daa76b824c23a656f3fd100410f6290b

SHA1
d66c5c8a329f04edd5606d50867f73893f6571b5

SHA256
530c3709dd5877993b7077aa98a1926b666be54ec02fa1b280718030fb0d80f9

SHA512
fce627ba3410ce8422a1f56bc1ad23a4fa6df203a6e5efb839b0f5e81a6b8cc8cd018ca9a40bb31b37bf6972527a2e20928d6b634d85233531633559e7a689f9

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
529b2a36e9319ed2448dad94486f6c89

SHA1
2175735df96b1341d7896270a4a1cb33493ad5f8

SHA256
9a595e1d12793ebcc172d9d55f800fa2b78f111152950d9550fead51d8c1d499

SHA512
deb0250339f91a71286f00dbb48d01d12e9fdc04d05f14660ccc5a3a62c4dad39a037fd8bacfe5dd83bcb2078e5afaf8b0261267480b9e1d99fa4f53b37cb1fd

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
e4f7224ed356915816bebb715326d18a

SHA1
8b441bb4276212b9e774cba75fdbb723cb68af93

SHA256
74378574282fceda54a869e384dffdf9d7d202d5a1937d781fcc501d6115e93c

SHA512
5a7fc84ea39311ef5277aaf3fa0e207b6e095ec236ea877756da7849d38678b8e73a7bd5ea49ae51ae730adc2a56cd79dd0fc3be63bcbb58ae50f9f030140ba2

Download Submit

Analysis

Sharing