Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24-12-2023 20:25
General
-
Target
10c182e0e705aa72cdb4491752f8f2e0.exe
-
Size
547KB
-
MD5
10c182e0e705aa72cdb4491752f8f2e0
-
SHA1
2412206ea3c6084a6764ee42b756f6f6a8c745d1
-
SHA256
e6f19ef7ad9485dbb3bcc7f5cdca8b6dd388837c72f1c0f64730fe6e85b5537b
-
SHA512
6b8c80c674a970dabd6b86d5a9cccf6f4c8bfe4ce28b64a3008b12ebfc16fb8b28cef9c24b352396098b751e0e7913723aa176454f9b33a69f67ffb87f731918
-
SSDEEP
12288:gVnvmlaX9OOr3SCQ0F+bJ8SDmH/P3veRt9ahLXhj5RAT8:gVngK3HQzJtDmXfeRtQhLxj5R/
Score
10/10
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10c182e0e705aa72cdb4491752f8f2e0.exe"C:\Users\Admin\AppData\Local\Temp\10c182e0e705aa72cdb4491752f8f2e0.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage