flawedammyy | b34545c6faf06eab1ca4db9d5378a0ca775d4d45e5b2fb6ee88e07180d240c70

Analysis

max time kernel
54s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AmmyyAdmin_v3.exe
Size

701KB
MD5

61e9063d98bd8ceb0eb78332996e1fe5
SHA1

95c0575928ed459928d70ab4d82199a092cf7d90
SHA256

5cf1cc749208121e38b2984edca4583997ba72e8225ef94512debf9794c9192a
SHA512

238d302f03b83906184b5d1cd6afaa8b2429f8d16a18ac759fe65eb0aa86de29a8b59f5fea53fa61803519837c6715b8d283877f27a1e34a4c4a2d8425e3c8cd
SSDEEP

12288:lA4uNgU63ohsfC0acs34Br2z1Rt9adJ75+z8BNzbgc:bFUCMs9a5II1RtwdJt28BNAc

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AmmyyAdmin_v3.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\International\Geo\Nation	AmmyyAdmin_v3.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

AmmyyAdmin_v3.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	AmmyyAdmin_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AmmyyAdmin_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AmmyyAdmin_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	AmmyyAdmin_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c10595327e8ca0b6b69b26b	AmmyyAdmin_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 330f5167e22384b15c4e3d68284df99f4aa12ffd84da45ccc3cd941a8f0716b260c3fb9731c84ccc87a2f05344a3eaf6d4772ae897276f92faaa54bbee60f65d8b3a7d82	AmmyyAdmin_v3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AmmyyAdmin_v3.exe

pid	Process
2328	AmmyyAdmin_v3.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

AmmyyAdmin_v3.exe

pid	Process
2328	AmmyyAdmin_v3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

AmmyyAdmin_v3.exe

description	pid	Process	procid_target
PID 1988 wrote to memory of 2328	1988	AmmyyAdmin_v3.exe	17
PID 1988 wrote to memory of 2328	1988	AmmyyAdmin_v3.exe	17
PID 1988 wrote to memory of 2328	1988	AmmyyAdmin_v3.exe	17
PID 1988 wrote to memory of 2328	1988	AmmyyAdmin_v3.exe	17

C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin_v3.exe"
1⤵
PID:1732

C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin_v3.exe"
1⤵
- Checks computer location settings
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2328

C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin_v3.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
231f00983dd712c247e780357a93433c

SHA1
03f56695c42d485857214aa6f3cdafc78a1f1d98

SHA256
afdb4bdd11cae1f6a6c30e3530c1f3c029ef1a330a54546134563f8b2a7d031a

SHA512
ce71a8b529c7d89ec395359233ef24a55b6af747256e462b8a1868a7776c50ac459e86377741dcbb2e7d4c6c92b534146f83373904bf567018f90e81b6bb6a50

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
7d0bc0f42b0c1407e78ed285c5224a58

SHA1
e0ed0070c6c651853c7e494e9060ed49eec0b872

SHA256
5c77d0b633d9526d1de705a513fc646d922c26bb7c9b30831bc8991cfb35b4f0

SHA512
9385c0b177c40418a8a13cdd32ba3aeeec5640072e1c4ae7f844e360899562bb5322e2481606e0e2361b70f70247c7eb64f42a734c07d2e90b03d1e5cba73d6d

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit