ammyyadmin | 072530596cf321307e06c2dfc486616f40f820ece1a43c1bbfedffa35c3044ee

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 10:01

Target

103fba226301d18ab690d0864cd42199_JaffaCakes118.exe
Size

994KB
MD5

103fba226301d18ab690d0864cd42199
SHA1

84e218b4896a2c3ade5dbf3ede78cbb1ed9bdc83
SHA256

072530596cf321307e06c2dfc486616f40f820ece1a43c1bbfedffa35c3044ee
SHA512

d73b5e715c75768dacdc7029bdf9f8e0594b6c066d4e7161825db2ffd2ccfaec8e20d5ef16d534d11052e11cf2596c4a22852058608adbc5b982d8df837abe8a
SSDEEP

24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxx:dJ5gEKNikf3hBfUiWxx

Score

10^/10

ammyyadmin rat

AmmyyAdmin payload 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\budha.exe	family_ammyyadmin

Executes dropped EXE 1 IoCs

Processes:

budha.exe

pid process

1384 budha.exe
Loads dropped DLL 1 IoCs

Processes:

103fba226301d18ab690d0864cd42199_JaffaCakes118.exe

pid process

1252 103fba226301d18ab690d0864cd42199_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1384	budha.exe

pid	process
1252	103fba226301d18ab690d0864cd42199_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

103fba226301d18ab690d0864cd42199_JaffaCakes118.exe

description	pid	process	target process
PID 1252 wrote to memory of 1384	1252	103fba226301d18ab690d0864cd42199_JaffaCakes118.exe	budha.exe
PID 1252 wrote to memory of 1384	1252	103fba226301d18ab690d0864cd42199_JaffaCakes118.exe	budha.exe
PID 1252 wrote to memory of 1384	1252	103fba226301d18ab690d0864cd42199_JaffaCakes118.exe	budha.exe
PID 1252 wrote to memory of 1384	1252	103fba226301d18ab690d0864cd42199_JaffaCakes118.exe	budha.exe

C:\Users\Admin\AppData\Local\Temp\budha.exe
"C:\Users\Admin\AppData\Local\Temp\budha.exe"
2⤵
- Executes dropped EXE
PID:1384

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
994KB

MD5
b728e1a0ffc4573affc3ed003067b979

SHA1
536b74939580de54996b276394ba02839ddeac9f

SHA256
53f09721bdd68ce1c96b972d709357df15a64aaee3fc3b35836eed8cddd85dbf

SHA512
6b577e522de2a0c80fa7a7998741990134c86d9d8e423afd40acf024766421bbabbae71ce82801f9b22fd36981ca90740b56068bc4181e2f27cdc77e6f3a0bf0

Download Submit
memory/1252-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1252-1-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/1252-3-0x0000000002790000-0x0000000002B90000-memory.dmp

Filesize
4.0MB

Download
memory/1252-8-0x0000000002E60000-0x0000000002E6A000-memory.dmp

Filesize
40KB

Download
memory/1252-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1384-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1384-13-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/1384-15-0x0000000002870000-0x0000000002C70000-memory.dmp

Filesize
4.0MB

Download
memory/1384-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download