flawedammyy | d37a1406fe50b4b4a832ddeb77d631d613b127c24535afd876b836f6ed4bd464

Analysis

max time kernel
98s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Size

713KB
MD5

c59be0a84718d97a82cfa59860bdab3a
SHA1

2a0df9bf173e167f90331d4ba4b05720ba6d37e4
SHA256

924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54
SHA512

245e9b6d513ca17ba8561e40b3c3a5cccc5b2256358fbf30383a72050f0c817d2272284a92a8b22f75908f86474f6367beb16ebc143c9b96ad64d7e5bff3862b
SSDEEP

12288:dVr29UGEg6VUM5oAL1jq3E2jj0NOjAqHKtCessZWjya7VM1en9Nm1RtNeCVao2Vp:vUbj4qwCessA41Rt0CVMVZtxP

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e155253e61806e2c364b26b	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 1da896f62da5524da4640defadea8b93419b20ba58eeb10dacb309d426f3685a3849866a975c752a690927e01cd0d52e88278d8035fd221a95c1410f4b9657ab172299d2	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

pid process

3300 924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

pid process

3300 924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

pid	process
3300	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

pid	process
3300	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

description	pid	process	target process
PID 2788 wrote to memory of 3300	2788	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
PID 2788 wrote to memory of 3300	2788	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
PID 2788 wrote to memory of 3300	2788	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe"
1⤵
PID:1840

C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
  "C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
9170b8830be291cdf01de203d44491f7

SHA1
b0792c514145d5133dae318c87483fd848bfb1bc

SHA256
5f19e1f4432fda29ec1c5113e618ee48e4ffdc804e84479ba71d87b6caeeaa6e

SHA512
7602d4a8128404034364e65a6e01edfdf78f402920afd4766c3f667ba4d9f04b76dadd0f6d3e8e5ce280a9d26ebad96dd881fde7615358ca96a1120bc117182e

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
7e442866f759a2be98be4b069a31e6df

SHA1
cea28271342ee658170c9cd35e1293f9274382f5

SHA256
1ab0f93b875e05dfeed69213d749e44b3ee2f018347358e55e00f1bff4fde196

SHA512
525265010718671f0255724c28602478924442cc2f4acc307e35b256eada7216c47d7ba35cad314191bbe83156ec875adc9657aeec340ad4d199e6a1785132d5

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit