flawedammyy | 847a62b88f8e17d9face6fac84037a125f66c4db0f1cdbf464305f053578d37b

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18966a28fba7a616962f90694009a466.exe
Size

708KB
MD5

18966a28fba7a616962f90694009a466
SHA1

4f7ac1f55f093bf3c7dc0fb6971a6da701793a56
SHA256

847a62b88f8e17d9face6fac84037a125f66c4db0f1cdbf464305f053578d37b
SHA512

3a0073e82cdf16bb3accb1512f2bfb5da15ab9f12eeb0616fedfbed2a877fcf52be91017523ab121549e3b0a2501974137c0d88c2c56472f6adf45f0a021b8bd
SSDEEP

12288:yVr29UGEg6VUM5oAL1jq3E2jj0NOjAqHKtCessZWjya7VM1en9Nm1RtNeCVao2Vy:oUbj4qwCessA41Rt0CVMVZtxI

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	18966a28fba7a616962f90694009a466.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e1552530f4554a97161b26b	18966a28fba7a616962f90694009a466.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = d0788a0b22e9cad0b0d0ef58a0cd6da952a5b1a2d91e2a90bf7cae0111f85e2819ee82af29f9bb2094c70232a751190a6978da9f3d341c9d40b6b58205774161315328e8	18966a28fba7a616962f90694009a466.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	18966a28fba7a616962f90694009a466.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	18966a28fba7a616962f90694009a466.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	18966a28fba7a616962f90694009a466.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	18966a28fba7a616962f90694009a466.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3744	18966a28fba7a616962f90694009a466.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3744	18966a28fba7a616962f90694009a466.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3744	1628	18966a28fba7a616962f90694009a466.exe	90
PID 1628 wrote to memory of 3744	1628	18966a28fba7a616962f90694009a466.exe	90
PID 1628 wrote to memory of 3744	1628	18966a28fba7a616962f90694009a466.exe	90

C:\Users\Admin\AppData\Local\Temp\18966a28fba7a616962f90694009a466.exe
"C:\Users\Admin\AppData\Local\Temp\18966a28fba7a616962f90694009a466.exe"
1⤵
PID:4256

C:\Users\Admin\AppData\Local\Temp\18966a28fba7a616962f90694009a466.exe
"C:\Users\Admin\AppData\Local\Temp\18966a28fba7a616962f90694009a466.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\18966a28fba7a616962f90694009a466.exe
  "C:\Users\Admin\AppData\Local\Temp\18966a28fba7a616962f90694009a466.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
cbf78409cb00324c3b66a9eb0d6a9ff8

SHA1
f7c8bc7507b8f29e7eb493a46220b84dfb40e423

SHA256
5934c03cc26a314e7c51ae964372778bcf7e171bb884a25d96aff5899847b620

SHA512
863a114a10557b6fe9dff93349b0ce350960016f9c5fef376feab5b28ecb62d8cf515dbffaef93b73af6c0441ea63193290216c61a01b3866556a11ea6d59d06

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
e14fd36ade95f97b9930ae6c6f0f4aaa

SHA1
76b97bf164422d31e999ced5216deae1b97254d2

SHA256
909d8e83dc22472ed4e79ae5a278f9135f27a05c3b6011f8570a1012e41b26b4

SHA512
b7eab2be21b897dec146f7bcc65d1e563440ef77071a674ffcc855464c443085dc0e16c6b85fc3ddee7c25685306b2d7f3270d704bb4cddbbec70ddf797d68f5

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
281B

MD5
0ab37e79601368085b4631f7a9c5597f

SHA1
7144ec339f1a518775a4719f3c1b5b2572775c1f

SHA256
142eee7e8791e4bd6f1e6bddacab55563c33069db8a977ea4416479ea5c1b565

SHA512
7cec54972600f22f4024a90b145114fb5b6f2f1e20882495d36b0dd1a4f4174a11eacb4dda66d457b7193bdc328f8bf909b6e73cd9e0c3bfd46cb8018b926a55

Download Submit