ammyyadmin | a79fbedff8cd34a6a5624defca2f478e305586f661d5419459ccf098a060ae8d

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 22:57

Target

2218a0c5268e7e870311f04d56d2792a_JaffaCakes118.exe
Size

994KB
MD5

2218a0c5268e7e870311f04d56d2792a
SHA1

0c502806cc2efb3a68287e4813a7a85a9c511a60
SHA256

a79fbedff8cd34a6a5624defca2f478e305586f661d5419459ccf098a060ae8d
SHA512

4f5163e4ba9ff68caca5d24371a84106d5783e0a1682b0241c41e03ac7e5fa5754dc3bb4315d5f0ca99b770a1970ba26e710cb0c46361e759b69c8b293f46ddd
SSDEEP

24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxI:dJ5gEKNikf3hBfUiWxI

Score

10^/10

ammyyadmin rat

AmmyyAdmin payload 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\budha.exe	family_ammyyadmin

Executes dropped EXE 1 IoCs

Processes:

budha.exe

pid process

2480 budha.exe
Loads dropped DLL 1 IoCs

Processes:

2218a0c5268e7e870311f04d56d2792a_JaffaCakes118.exe

pid process

2488 2218a0c5268e7e870311f04d56d2792a_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2480	budha.exe

pid	process
2488	2218a0c5268e7e870311f04d56d2792a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2218a0c5268e7e870311f04d56d2792a_JaffaCakes118.exe

description	pid	process	target process
PID 2488 wrote to memory of 2480	2488	2218a0c5268e7e870311f04d56d2792a_JaffaCakes118.exe	budha.exe
PID 2488 wrote to memory of 2480	2488	2218a0c5268e7e870311f04d56d2792a_JaffaCakes118.exe	budha.exe
PID 2488 wrote to memory of 2480	2488	2218a0c5268e7e870311f04d56d2792a_JaffaCakes118.exe	budha.exe
PID 2488 wrote to memory of 2480	2488	2218a0c5268e7e870311f04d56d2792a_JaffaCakes118.exe	budha.exe

C:\Users\Admin\AppData\Local\Temp\budha.exe
"C:\Users\Admin\AppData\Local\Temp\budha.exe"
2⤵
- Executes dropped EXE
PID:2480

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
994KB

MD5
733158d0295fef28fa2344e8f043fdd2

SHA1
49aee90c61630b242d2a76b00d66362fa3a7f253

SHA256
3b337024cd91748ef9298b193c3bef28cc23e2e88d5187e49f90faa13f73a0dd

SHA512
5606877bed6b51d5a32e1453e05bbe3a850d6d8902e8f6cfae5864b3ad143056450fef378950e1eb328ae13c91e1a849d87f78e8df64dd82a8c1c0eb3dcd0e41

Download Submit
memory/2480-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2480-14-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/2480-15-0x0000000002AA0000-0x0000000002EA0000-memory.dmp

Filesize
4.0MB

Download
memory/2480-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2488-1-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/2488-3-0x0000000002B10000-0x0000000002F10000-memory.dmp

Filesize
4.0MB

Download
memory/2488-7-0x0000000003220000-0x000000000322A000-memory.dmp

Filesize
40KB

Download
memory/2488-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download