Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13-01-2024 01:21

General

  • Target

    349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe

  • Size

    722KB

  • MD5

    45c9b54d66cbcc2de89f93e25f368a45

  • SHA1

    2e5265f35f75a50c89e592e127bc80e1e45aa840

  • SHA256

    349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a

  • SHA512

    25c3f1ec6d2e233464090f584777b15f18acfd1cb12124c236680689545ec8208bc364d26d7202e38368dbec34cd824600afb51845df8c9de8c8e83fba8d8b1f

  • SSDEEP

    12288:x2QKNGp2YPjE0d63iVg5Bfi781Rt1hpGqzdpW9eKVQvTPRpsbS5hEgK:xSIp2Ydd6SVcpz1RtXpGadsbShK

Score
10/10

Malware Config

Signatures

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe
    "C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe"
    1⤵
      PID:2504
    • C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe
      "C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe" -service -lunch
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe
        "C:\Users\Admin\AppData\Local\Temp\349f7e00ee29b349b00c32318cb9b829b162167702957295712d37ebbb2a7a9a.exe"
        2⤵
        • Checks computer location settings
        • Modifies data under HKEY_USERS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\AMMYY\hr

      Filesize

      22B

      MD5

      10e36534e3a430a7d6454691dbeae67b

      SHA1

      7efe762d71c21946c356712de413ff960bdbf172

      SHA256

      7037dbfb6e6540ae0ef35c0fcfb3df9025df03ce21064b77093dee67d44b4c84

      SHA512

      8993d0f5549fbd4227f9916fce694b44b248de44b0196ca030b00d4b0138692ccb78f90e24f0716d5a154a3f52471aec0c177c88cf8e219cea8569c0848b8dbd

    • C:\ProgramData\AMMYY\hr3

      Filesize

      68B

      MD5

      705665c5be0ac7b2a7f222f07f0f70ab

      SHA1

      0fa66133d02dc318a15f340d1745bf509cc8c62f

      SHA256

      ad9c5c384b8d32906055b2f84deaa20e3bc0157dd7db238b3817136f6fa6c2e6

      SHA512

      77b4388a123879895ace80eb0dd2c7303116a652dc4e9a2c789251f6c5ca1c75f627513cb8229174d359ef1a824e9e718e375c4337f122305f9064fbba02c9ad

    • C:\ProgramData\AMMYY\settings3.bin

      Filesize

      270B

      MD5

      6910d9160b66c4395f587a279e80f132

      SHA1

      54949c04c8c0970aa5e2d3fb2912318daab97b98

      SHA256

      72d44ac6019d486fc1a58334ff8ed692de0a9ed96de3142638c71376ceade87c

      SHA512

      82967a8bdbad58f2a81d063c84294153dbdd86322d4b6e3631122530dc7f00fd209ed1d2b0683eb60f726fd3d6f93c7615bd1d0d1fa1f5441119d0e5007582b9