ammyyadmin | 3626f2ec2137a5c30479baa33ec81e4eb1b3d018baf59200547e742b8b4a76e2

Analysis

max time kernel
142s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe
Size

993KB
MD5

3a37860ff81fc1f7a9618757bbbcc9e4
SHA1

16abe227b3cc35847fb0caffa6536d13bcafe41d
SHA256

3626f2ec2137a5c30479baa33ec81e4eb1b3d018baf59200547e742b8b4a76e2
SHA512

5a1efe72274501492c761af0b998562adc6e08fe866a992dda6e026f336175fa160c4753535a65d975546553f99a6b07137eee66163ac9dadfa64a06de0c214e
SSDEEP

24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxX:dJ5gEKNikf3hBfUiWxX

Score

10^/10

ammyyadmin rat

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000233c0-7.dat	family_ammyyadmin

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4784	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 4784	1328	3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe	84
PID 1328 wrote to memory of 4784	1328	3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe	84
PID 1328 wrote to memory of 4784	1328	3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a37860ff81fc1f7a9618757bbbcc9e4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
994KB

MD5
5589b3d6462a23ad068b72ab28c48f4e

SHA1
29a97e97f2de53456b85ccd75056791db9e29792

SHA256
8973555111e7b8ba82999b62bccfab12bbb2b652d6f6d7ce751d2fab00062503

SHA512
011afd98583452ecacd6acecf84f997fdec773b6bd82902068ecd3ef0f8cb631ecf54e18936a62589b00660129e70c343b05d55574dbb44aa1a1ccbe502620cc

Download Submit
memory/1328-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1328-2-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1328-3-0x0000000002690000-0x0000000002A90000-memory.dmp

Filesize
4.0MB

Download
memory/1328-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4784-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4784-14-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/4784-15-0x00000000025B0000-0x00000000029B0000-memory.dmp

Filesize
4.0MB

Download
memory/4784-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download