flawedammyy | e1b9d77cb265711831aca195fb1ca299b9e6b2df18b8c086c26876151f57e837

Analysis

max time kernel
177s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2023 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
Size

709KB
MD5

2104f66da494fb2cac8d654f02cd85d7
SHA1

98e44b9c65c15384da664d1b548e408b486e47bc
SHA256

5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a
SHA512

24cebfda8f1b90bc542f19d3c0ae8e7b51771c4e7e5b2fd2560dec1866b74f1172d85a6dbbf809a5f5bb9ecbac6a25db3477e8eec2fdb2d5f55fe4470b1555dc
SSDEEP

12288:J/VanOH+kAX8CrJpc4+9djmLfN971Rtc3MmylZDaehlJgJ:faOH+kbCr/c4+9hm7r1Rt4MmylZDV6J

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e155253329288273d7bb26b	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = d97f87581ad15b9eae1106e123d467c48771b0911ae5f92336cefeba74e58be2589d9bb1a22edc178a986a361a06c675cdccaae004d801bd0c1906f5c040661dcea7e291	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

pid process

4424 5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

pid process

4424 5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

pid	process
4424	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

pid	process
4424	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

description	pid	process	target process
PID 3768 wrote to memory of 4424	3768	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
PID 3768 wrote to memory of 4424	3768	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
PID 3768 wrote to memory of 4424	3768	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe	5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe

C:\Users\Admin\AppData\Local\Temp\5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
"C:\Users\Admin\AppData\Local\Temp\5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe"
1⤵
PID:4568

C:\Users\Admin\AppData\Local\Temp\5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
"C:\Users\Admin\AppData\Local\Temp\5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:3768

C:\Users\Admin\AppData\Local\Temp\5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe
"C:\Users\Admin\AppData\Local\Temp\5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a.exe"
2⤵
- Checks computer location settings
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
ef49c4e52a158492dafdc8bc32b3d9f9

SHA1
d00905acfd74e3f1690c0dce056c642bc93eb2ea

SHA256
1f5f6723edf7d345b336c7aa18f624ff6d14ed4af28a0d5cd6db531bb00cf9de

SHA512
e016d3b586858ef50c8e8d1a2de7ca5f693cf4c0b255f5935f7f54fbde775bd36ad99023698b8e3f3bf4dd69f48186fa080dc02487ad27afebf1a7f6df3ebde6

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
65004bc7e97cdefcb0b5136d49a3190b

SHA1
401a12c244b16b49869a792eceb7415b0ebbb653

SHA256
4e35a5ebcfbd651f4d37e05db52df93b58e22d007b03a608dfe6b41f432dad17

SHA512
7074f878deef41e72a6212c8e651eedb014e39cf2c76dd35dec88647fa1b1a7bc5e9422214d0b111854d3eecf56b88229783c3355bb196c27fa270ee748bc881

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit