Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06-02-2024 19:04
Behavioral task
behavioral1
Sample
AlphaZackCosmos.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
AlphaZackCosmos.exe
Resource
win10v2004-20231215-en
General
-
Target
AlphaZackCosmos.exe
-
Size
751KB
-
MD5
4d853025b8cd8c725bf78e3df6cce967
-
SHA1
c6bff7857fdf33cbd8f052ef5d669675e5cf06f8
-
SHA256
4f648c95b8c832742b8b43f4e70689d0ef0328841744858c75d0a4e98fda5ff8
-
SHA512
977e43eaa763cc66114e00a615818c66a84a5a47bac1cdf21eff9f8f1dcebf138d8ede823265a2f30807d648c57bf036818254964358691d3f9a013f930705cf
-
SSDEEP
12288:Tc0dZib4t9uOroAgUHvCUt4RtlTc+YNKpQsNvVd1gF:Tc/UtwOrZgUHv54Rt6+YNkQsNmF
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AlphaZackCosmos.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\International\Geo\Nation AlphaZackCosmos.exe -
Modifies data under HKEY_USERS 7 IoCs
Processes:
AlphaZackCosmos.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings AlphaZackCosmos.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin AlphaZackCosmos.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE AlphaZackCosmos.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy AlphaZackCosmos.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin AlphaZackCosmos.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796e5f5e4c10595357a903566706b26b AlphaZackCosmos.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = a3b84b4d66964aab8b081fd743e98bcaa00325be7a6a6fda112732cad75b6cab7c6481bf5c9d48c97d1541e13bb9a4e4cfdb8370dfdd9da60d6253b3108cc56ab54c83d1 AlphaZackCosmos.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AlphaZackCosmos.exepid process 2664 AlphaZackCosmos.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
AlphaZackCosmos.exepid process 2664 AlphaZackCosmos.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
AlphaZackCosmos.exedescription pid process target process PID 2372 wrote to memory of 2664 2372 AlphaZackCosmos.exe AlphaZackCosmos.exe PID 2372 wrote to memory of 2664 2372 AlphaZackCosmos.exe AlphaZackCosmos.exe PID 2372 wrote to memory of 2664 2372 AlphaZackCosmos.exe AlphaZackCosmos.exe PID 2372 wrote to memory of 2664 2372 AlphaZackCosmos.exe AlphaZackCosmos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AlphaZackCosmos.exe"C:\Users\Admin\AppData\Local\Temp\AlphaZackCosmos.exe"1⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\AlphaZackCosmos.exe"C:\Users\Admin\AppData\Local\Temp\AlphaZackCosmos.exe" -service -lunch1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\AlphaZackCosmos.exe"C:\Users\Admin\AppData\Local\Temp\AlphaZackCosmos.exe"2⤵
- Checks computer location settings
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD54f2522b9b98cecf473be2b8333dc2970
SHA134a1bb12f924537facb4f451ab24a7f239de2b41
SHA256cfbba4126c10b4ede87d9986a0fb613366e6d618ab13495b899555e4acc0ee4c
SHA51286e24e7466725cca0880d6988ce7725dbde09cd2b08ee778336599d004220a159f801ea4989022aabdecf000bdcf1b1004f7a168008e8d8ed490027e500352aa
-
Filesize
68B
MD56e5bebb322760f1591312914a151a2e1
SHA1bef2936b182f12d921eda3d6ee683dc6afc10a78
SHA256b0f98844077f10c694273c4eb394f9c2152a04a2414f53dced9ce0f39eeca08d
SHA5123a2e27c449a52b61508a3c2813b089aeb84b15fa8c2b97b3eed3589dba18db4cbed54ee1ecbe9046905681df816f6e1a587e63177452b3c934facbb3ecf6a145
-
Filesize
271B
MD5714f2508d4227f74b6adacfef73815d8
SHA1a35c8a796e4453c0c09d011284b806d25bdad04c
SHA256a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480
SHA5121171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8