Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-01-2024 09:57

General

  • Target

    Ammyy Admin Corporate v3.5.exe

  • Size

    746KB

  • MD5

    2fcbad97d4443200c6d103b7474466f0

  • SHA1

    a94db856006bbf526d57217ff4d4b2f73ee53f7c

  • SHA256

    4ce31888140938c0409b7bd9bd46914232fc2d490181eb8ceb74941056a2b765

  • SHA512

    56c093e09ecab1e9a99b99638591fdd4824ce84e68e7daddc228d1e479a8d51304ed8d72b511cdb4ec74292d0a0bb42ff02761001f0296503aca7c0e66565516

  • SSDEEP

    12288:PUYiJqMH2OwlaUPcWWwTXZV8f64RteVpN5ETMasTjcP6gX:ziJJWOwlaUPcWWwDZb4Rt+N5WMasHoX

Score
10/10

Malware Config

Signatures

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Drops file in System32 directory 4 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe
    "C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe"
    1⤵
      PID:4668
    • C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe
      "C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe" -service -lunch
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe
        "C:\Users\Admin\AppData\Local\Temp\Ammyy Admin Corporate v3.5.exe"
        2⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1620

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\AMMYY\hr

      Filesize

      22B

      MD5

      a67433748cfcf149a6f63071bbde1978

      SHA1

      9b05433668ccc5327ebc49ea955d1896c26b8cc2

      SHA256

      a8597edf1c34a5bfb0d935f22297865160c978933a9598ca29cd8048b21f3195

      SHA512

      642da2a6a70c567a5f538d9462ff74a043df73f05a936a4b6f8f72d7eaf797496f3bc1d6c7d6f4947b5a6840a0118d43f0e99600150bf99e0de1f797af55418a

    • C:\ProgramData\AMMYY\hr3

      Filesize

      68B

      MD5

      8ffec72a7c2f98a1ea5b67c9920b6af5

      SHA1

      0ab9228671c49f71986742a8973286d127a0d0a2

      SHA256

      e9ec86c22e004ba61066c9754f5be108e333a5db42db68743212b174e769b6e8

      SHA512

      889d26de53fd6409150838a507ef2c5e62e6fe028fe8fc8361288caccf51a356a08c59aedf298bab3da3fe5f6ab5a7420e5babe9117693cd3e90f45d4a5f97d5

    • C:\ProgramData\AMMYY\settings3.bin

      Filesize

      271B

      MD5

      714f2508d4227f74b6adacfef73815d8

      SHA1

      a35c8a796e4453c0c09d011284b806d25bdad04c

      SHA256

      a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

      SHA512

      1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8