ammyyadmin | 6b83890e57f90e2027ddb6560abef71bfc5e1794934c321ee92c836238bd21c1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aec2c26dfeda66721313e8666d3edd0_JaffaCakes118.exe
Size

998KB
MD5

0aec2c26dfeda66721313e8666d3edd0
SHA1

b6cd5ac8a17e52422fd6ba0eb7786758a8491c14
SHA256

6b83890e57f90e2027ddb6560abef71bfc5e1794934c321ee92c836238bd21c1
SHA512

fc88e1ecb73798bfd68abb99a817bfd05bfe3c9d17c85021232b01638c9f91a9a2c9fc97bd62b8766be66f7165c62b60a6e12c31193d195aa979c3fa693c3999
SSDEEP

24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxa:dJ5gEKNikf3hBfUiWxa

Score

10^/10

ammyyadmin rat

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a00000002343d-7.dat	family_ammyyadmin

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	0aec2c26dfeda66721313e8666d3edd0_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3372	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3372	4952	0aec2c26dfeda66721313e8666d3edd0_JaffaCakes118.exe	82
PID 4952 wrote to memory of 3372	4952	0aec2c26dfeda66721313e8666d3edd0_JaffaCakes118.exe	82
PID 4952 wrote to memory of 3372	4952	0aec2c26dfeda66721313e8666d3edd0_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0aec2c26dfeda66721313e8666d3edd0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0aec2c26dfeda66721313e8666d3edd0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
998KB

MD5
a5105daf76c3ca92fc6f9d2be44c32fe

SHA1
ccce02f6f4895d7a5e59a67ff8f70b734a82580f

SHA256
99524c1c2bd8a965b31e3227df4d52c238ff47ed03255fb19884d2b59852015a

SHA512
50c372b413541152167933c0737434f05c4e9e815b20a520ba4669ced5587e8b303c2b8ab1be4d6dd2967f9cef53f8075b7f85b055982f68f1335583ee6bd593

Download Submit
memory/3372-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3372-14-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/3372-15-0x00000000025A0000-0x00000000029A0000-memory.dmp

Filesize
4.0MB

Download
memory/3372-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4952-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4952-1-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/4952-3-0x00000000025E0000-0x00000000029E0000-memory.dmp

Filesize
4.0MB

Download
memory/4952-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download