Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 09:57
Behavioral task
behavioral1
Sample
Ammyy Admin Corporate v3.5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Ammyy Admin Corporate v3.5.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
sainetco.ir.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
sainetco.ir.url
Resource
win10v2004-20231215-en
General
-
Target
Ammyy Admin Corporate v3.5.exe
-
Size
746KB
-
MD5
2fcbad97d4443200c6d103b7474466f0
-
SHA1
a94db856006bbf526d57217ff4d4b2f73ee53f7c
-
SHA256
4ce31888140938c0409b7bd9bd46914232fc2d490181eb8ceb74941056a2b765
-
SHA512
56c093e09ecab1e9a99b99638591fdd4824ce84e68e7daddc228d1e479a8d51304ed8d72b511cdb4ec74292d0a0bb42ff02761001f0296503aca7c0e66565516
-
SSDEEP
12288:PUYiJqMH2OwlaUPcWWwTXZV8f64RteVpN5ETMasTjcP6gX:ziJJWOwlaUPcWWwDZb4Rt+N5WMasHoX
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Drops file in System32 directory 4 IoCs
Processes:
Ammyy Admin Corporate v3.5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 Ammyy Admin Corporate v3.5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE Ammyy Admin Corporate v3.5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies Ammyy Admin Corporate v3.5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 Ammyy Admin Corporate v3.5.exe -
Modifies data under HKEY_USERS 9 IoCs
Processes:
Ammyy Admin Corporate v3.5.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE Ammyy Admin Corporate v3.5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Ammyy Admin Corporate v3.5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Ammyy Admin Corporate v3.5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Ammyy Admin Corporate v3.5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin Ammyy Admin Corporate v3.5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy Ammyy Admin Corporate v3.5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin Ammyy Admin Corporate v3.5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e15525314c9fc7b141fb26b Ammyy Admin Corporate v3.5.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 09c13c27a3023c56484e3d68284d35832edb9d3b766ce178b8444eae892ef5aa0fe212ef3f6a299995367f8d540551a9e13f9b3a5ed286e004363048a023972f2844fb51 Ammyy Admin Corporate v3.5.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Ammyy Admin Corporate v3.5.exepid process 1620 Ammyy Admin Corporate v3.5.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Ammyy Admin Corporate v3.5.exepid process 1620 Ammyy Admin Corporate v3.5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Ammyy Admin Corporate v3.5.exedescription pid process target process PID 5036 wrote to memory of 1620 5036 Ammyy Admin Corporate v3.5.exe Ammyy Admin Corporate v3.5.exe PID 5036 wrote to memory of 1620 5036 Ammyy Admin Corporate v3.5.exe Ammyy Admin Corporate v3.5.exe PID 5036 wrote to memory of 1620 5036 Ammyy Admin Corporate v3.5.exe Ammyy Admin Corporate v3.5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe"C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe"1⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe"C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe" -service -lunch1⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe"C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1620
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD5a67433748cfcf149a6f63071bbde1978
SHA19b05433668ccc5327ebc49ea955d1896c26b8cc2
SHA256a8597edf1c34a5bfb0d935f22297865160c978933a9598ca29cd8048b21f3195
SHA512642da2a6a70c567a5f538d9462ff74a043df73f05a936a4b6f8f72d7eaf797496f3bc1d6c7d6f4947b5a6840a0118d43f0e99600150bf99e0de1f797af55418a
-
Filesize
68B
MD58ffec72a7c2f98a1ea5b67c9920b6af5
SHA10ab9228671c49f71986742a8973286d127a0d0a2
SHA256e9ec86c22e004ba61066c9754f5be108e333a5db42db68743212b174e769b6e8
SHA512889d26de53fd6409150838a507ef2c5e62e6fe028fe8fc8361288caccf51a356a08c59aedf298bab3da3fe5f6ab5a7420e5babe9117693cd3e90f45d4a5f97d5
-
Filesize
271B
MD5714f2508d4227f74b6adacfef73815d8
SHA1a35c8a796e4453c0c09d011284b806d25bdad04c
SHA256a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480
SHA5121171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8