flawedammyy | 04df4d095a36105942be8be5c147948a99581b6f09c4d17c3e69345a4f2905f7

Analysis

max time kernel
187s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dll/UzakYardim.exe
Size 740KB
Sample240308-qt1jkshb2t
SHA256 55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
MD5 10a524d7ac94678ae286b065421647db
SHA1 b538e3f113817c8237419310ef47817d1d961fa9
SHA512 928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
SSDEEP 12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	UzakYardim.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	UzakYardim.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	UzakYardim.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	UzakYardim.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	UzakYardim.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	UzakYardim.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e1552531312c240152eb26b	UzakYardim.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 484e8d050c46a4d570aeb75387f49a132d552ad5a9abd2cd03968648af901891f85b7176f2775638537a89dec765653e40a779102c105e79e4a4515382aa370ffa9d0aba	UzakYardim.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	UzakYardim.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
940	UzakYardim.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
940	UzakYardim.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 940	3984	UzakYardim.exe	90
PID 3984 wrote to memory of 940	3984	UzakYardim.exe	90
PID 3984 wrote to memory of 940	3984	UzakYardim.exe	90

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
1⤵
PID:4668

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
  "C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\ProgramData\AMMYY\hr
Size 22B
SHA256 581933970ed622b78b2031308d523e7b0ad4f512192ef77702d0d136ae6a591e
MD5 a9d1d03bee202107fd1bbcd59a2ece65
SHA1 cf9f5c95c947f65fd4547f82591b7c03cded4a53
SHA512 24cd8eb9b2a0f0bcf28538b59d2beca857dd76faf24cdf70a5b2a15ac4f11a38c73491a95240448b6ab7a4e3f4c1172780f5aed8bfdd2a3b6e0017457746a817
MD5 SHA1 SHA512

Submit Download

hr3

Path C:\ProgramData\AMMYY\hr3
Size 68B
SHA256 42ed2ea3ec077eec455ad7f323bfb146519ee4a140c4ff24733e23fd4863e881
MD5 2e75e398017b1026fba96887d1d3e110
SHA1 e529165a52c7422740491ebdd1b4f70a1b922a30
SHA512 9c1aefcc81816664bc9e762e3726b57e2833838d5957abfd0fe13abaee4983cf2082fc3479d7dfddfc3b97717654d85a7687bc7e4e14fde92133af35166a2d75
MD5 SHA1 SHA512

Submit Download

settings3.bin

Path C:\ProgramData\AMMYY\settings3.bin
Size 331B
SHA256 cc8225e7412000f34a92f118af842d585d575498f36fe772dedad9f88c1fe5ad
MD5 c5b80443bc31f2f5c1d2e384c3b82961
SHA1 445a99fa06484d216276b9284eedf25483780216
SHA512 eae9247b9a1abbf8822ce65dbfd2db9b59a57367c7885614b89b8608688753e0c71fc8c955eb1493ef4dd7ba952760ff3476e05d9c177fb40661765a9e408d97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads