Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13-01-2024 01:21
Behavioral task
behavioral1
Sample
349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe
Resource
win10v2004-20231215-en
General
-
Target
349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe
-
Size
722KB
-
MD5
45c9b54d66cbcc2de89f93e25f368a45
-
SHA1
2e5265f35f75a50c89e592e127bc80e1e45aa840
-
SHA256
349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a
-
SHA512
25c3f1ec6d2e233464090f584777b15f18acfd1cb12124c236680689545ec8208bc364d26d7202e38368dbec34cd824600afb51845df8c9de8c8e83fba8d8b1f
-
SSDEEP
12288:x2QKNGp2YPjE0d63iVg5Bfi781Rt1hpGqzdpW9eKVQvTPRpsbS5hEgK:xSIp2Ydd6SVcpz1RtXpGadsbShK
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\International\Geo\Nation 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 055fb096d2bbb2bbf6b10be39c7110e5da0da1627ff8a3f3f4b922c63b1b1fe9979a251e21738d35208a66292286141520be474055d0d9910e257e8ac46cf00d0cd529b6 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c1059534712bbe5f61ab26b 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2000 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2000 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1608 wrote to memory of 2000 1608 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe 29 PID 1608 wrote to memory of 2000 1608 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe 29 PID 1608 wrote to memory of 2000 1608 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe 29 PID 1608 wrote to memory of 2000 1608 349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe"C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe"1⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe"C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe" -service -lunch1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe"C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe"2⤵
- Checks computer location settings
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD510e36534e3a430a7d6454691dbeae67b
SHA17efe762d71c21946c356712de413ff960bdbf172
SHA2567037dbfb6e6540ae0ef35c0fcfb3df9025df03ce21064b77093dee67d44b4c84
SHA5128993d0f5549fbd4227f9916fce694b44b248de44b0196ca030b00d4b0138692ccb78f90e24f0716d5a154a3f52471aec0c177c88cf8e219cea8569c0848b8dbd
-
Filesize
68B
MD5705665c5be0ac7b2a7f222f07f0f70ab
SHA10fa66133d02dc318a15f340d1745bf509cc8c62f
SHA256ad9c5c384b8d32906055b2f84deaa20e3bc0157dd7db238b3817136f6fa6c2e6
SHA51277b4388a123879895ace80eb0dd2c7303116a652dc4e9a2c789251f6c5ca1c75f627513cb8229174d359ef1a824e9e718e375c4337f122305f9064fbba02c9ad
-
Filesize
270B
MD56910d9160b66c4395f587a279e80f132
SHA154949c04c8c0970aa5e2d3fb2912318daab97b98
SHA25672d44ac6019d486fc1a58334ff8ed692de0a9ed96de3142638c71376ceade87c
SHA51282967a8bdbad58f2a81d063c84294153dbdd86322d4b6e3631122530dc7f00fd209ed1d2b0683eb60f726fd3d6f93c7615bd1d0d1fa1f5441119d0e5007582b9