ammyyadmin | 072530596cf321307e06c2dfc486616f40f820ece1a43c1bbfedffa35c3044ee

Analysis

max time kernel
142s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

103fba226301d18ab690d0864cd42199_JaffaCakes118.exe
Size

994KB
MD5

103fba226301d18ab690d0864cd42199
SHA1

84e218b4896a2c3ade5dbf3ede78cbb1ed9bdc83
SHA256

072530596cf321307e06c2dfc486616f40f820ece1a43c1bbfedffa35c3044ee
SHA512

d73b5e715c75768dacdc7029bdf9f8e0594b6c066d4e7161825db2ffd2ccfaec8e20d5ef16d534d11052e11cf2596c4a22852058608adbc5b982d8df837abe8a
SSDEEP

24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxx:dJ5gEKNikf3hBfUiWxx

Score

10^/10

ammyyadmin rat

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\budha.exe	family_ammyyadmin

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

103fba226301d18ab690d0864cd42199_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	103fba226301d18ab690d0864cd42199_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

budha.exe

pid process

4772 budha.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4772	budha.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

103fba226301d18ab690d0864cd42199_JaffaCakes118.exe

description	pid	process	target process
PID 4872 wrote to memory of 4772	4872	103fba226301d18ab690d0864cd42199_JaffaCakes118.exe	budha.exe
PID 4872 wrote to memory of 4772	4872	103fba226301d18ab690d0864cd42199_JaffaCakes118.exe	budha.exe
PID 4872 wrote to memory of 4772	4872	103fba226301d18ab690d0864cd42199_JaffaCakes118.exe	budha.exe

C:\Users\Admin\AppData\Local\Temp\103fba226301d18ab690d0864cd42199_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\103fba226301d18ab690d0864cd42199_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4872

C:\Users\Admin\AppData\Local\Temp\budha.exe
"C:\Users\Admin\AppData\Local\Temp\budha.exe"
2⤵
- Executes dropped EXE
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
994KB

MD5
b728e1a0ffc4573affc3ed003067b979

SHA1
536b74939580de54996b276394ba02839ddeac9f

SHA256
53f09721bdd68ce1c96b972d709357df15a64aaee3fc3b35836eed8cddd85dbf

SHA512
6b577e522de2a0c80fa7a7998741990134c86d9d8e423afd40acf024766421bbabbae71ce82801f9b22fd36981ca90740b56068bc4181e2f27cdc77e6f3a0bf0

Download Submit
memory/4772-13-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/4772-14-0x0000000002570000-0x0000000002970000-memory.dmp

Filesize
4.0MB

Download
memory/4772-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4872-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4872-1-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/4872-3-0x0000000002800000-0x0000000002C00000-memory.dmp

Filesize
4.0MB

Download
memory/4872-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download