Malware Analysis Report

2024-10-16 05:10

Sample ID 231201-sptlkscc97
Target 924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe.zip
SHA256 d8b31596ab62c0d031fb6565c893a401556fe00287c936c3400221e31c171cbe
Tags
ammyyadmin flawedammyy trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d8b31596ab62c0d031fb6565c893a401556fe00287c936c3400221e31c171cbe

Threat Level: Known bad

The file 924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe.zip was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy trojan

FlawedAmmyy RAT

AmmyyAdmin payload

Ammyyadmin family

Checks computer location settings

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-01 15:18

Signatures

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A

Ammyyadmin family

ammyyadmin

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-01 15:18

Reported

2023-12-01 17:11

Platform

win7-20231020-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe"

Signatures

FlawedAmmyy RAT

trojan flawedammyy

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c1059539703c72b317bb26b C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 4d987aae9121fdf42ab05738993014f4b822e1f734eaa944abbb81098eacca0442f5a060c2f7c1a79929996463b343a36db920f1f45f288f21271414419f467f1e6f8c57 C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe"

C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe" -service -lunch

C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp

Files

C:\ProgramData\AMMYY\settings3.bin

MD5 097a18ed7b31114c7ef39ef06eff02f0
SHA1 276bb5fc8ab72ed3a447dd57be668ace8f75a7c1
SHA256 985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812
SHA512 168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

C:\ProgramData\AMMYY\hr

MD5 375a8390212ccb650be4fcb6550a1b6b
SHA1 c9690dc2ec50dd7aea8b14ca88c1c1fd2865c5a7
SHA256 efacb255c29172fccecd0c9bbfd3f0f5a685e2e7e711d000dabac5691b5efbf6
SHA512 63be84af87f63083bf45b9e5a85ce9ae1b6186229cbceedf06cbbf92676ef682c4368a4d57c2869e10b63482b1ddb458b85b549def002f49c8e64c1681d2df73

C:\ProgramData\AMMYY\hr3

MD5 3bfc9a06afc0c547af1f7fded1ae9c91
SHA1 a584b9f0fc51b1dbc46ea99fad33ff0fe82ac82f
SHA256 dde6e563a4d70b47638d741401bf00cb2b0556f04db928273ec120b4f282a8fa
SHA512 fd985f65a755ba2cc9b79e83acfcfbbcb806d79be1d4b80a8448bad2d42d02700a6d594f5f216f45bb5c8f77f9759cef9bf9570a3e9dca344479f5ed532cce01

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-01 15:18

Reported

2023-12-01 17:20

Platform

win10v2004-20231127-en

Max time kernel

1s

Max time network

507s

Command Line

"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe"

Network

Files

N/A