ammyyadmin | 198f70a8827b1e9114dcd0c14191d495e52cd38393a1d603c62fc1ae7c48e3b2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe
Size

713KB
MD5

b47730495747868c2fa6f4ff3e94b7b0
SHA1

f8f1b33ed6231d01aae10ed8c89f31d11f38f06e
SHA256

198f70a8827b1e9114dcd0c14191d495e52cd38393a1d603c62fc1ae7c48e3b2
SHA512

91b2d33ca82d94084300d51fa206ab68e6ee1b94b779df8cce7c4fdf176c7037914566f3e53e7e7abbae44c7146dfbfcc3a9493d45a47a84e55325dd61d3c652
SSDEEP

12288:UVr29UGEg6VUM5oAL1jq3E2jj0NOjAqHKtCessZWjya7VM1en9Nm1RtNeCVao2Vp:uUbj4qwCessA41Rt0CVMVZtxP

Score

10^/10

ammyyadmin flawedammyy rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 4 IoCs

resource	yara_rule
behavioral2/memory/1288-0-0x0000000000400000-0x00000000004CB000-memory.dmp	family_ammyyadmin
behavioral2/memory/5032-5-0x0000000000400000-0x00000000004CB000-memory.dmp	family_ammyyadmin
behavioral2/memory/1288-7-0x0000000000400000-0x00000000004CB000-memory.dmp	family_ammyyadmin
behavioral2/memory/3964-6-0x0000000000400000-0x00000000004CB000-memory.dmp	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c69585c401452536731a86f6efab26b	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 34a83eae3f607aa64e6e109ff9fce9d6cbd5c05a4b84c2d06437709b5aea625db01c449e9fe9349a67d34f271f16cad1fb89bcb50da32f169660b370ffba780b0645fdb3	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3964	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3964	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3964	5032	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe	82
PID 5032 wrote to memory of 3964	5032	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe	82
PID 5032 wrote to memory of 3964	5032	b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe"
1⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\b47730495747868c2fa6f4ff3e94b7b0_NeikiAnalytics.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
e9246862b87ce9f508ce2693be527c1c

SHA1
df92ef5e799a208fa0bc9d6011aca952bd84e1e6

SHA256
0a97d2a96f3a1972be569336ab8080cedc6e7c896b0b2577a72295303e108dc2

SHA512
e387967dd9de6fa521f9d0541b0f90f8d913ea75bc6e0f75866e1bfcf2a370bd14f78055d6ba2e4c96af1ccf9e7ab4a58bcc61272e3f36ba2277c82c1641a91f

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
4c2f3ee8cec6242183c66948d460ab96

SHA1
42bd08985e23c5cd4df7ef71cc9c79a353460b56

SHA256
8e8e8e431e92c5b246cbb2c8a1284ccacbadf3fcd8f5190732cfebc66628327e

SHA512
a9ae6c396dae9acd5e3d4a12db39a98a549392d67ccbfc65d64bcf5aae6430e90a3f7f090c2471bde3e88b36ab754f6a6c1b837b2e3a383f5f4cbdcb041b97c0

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit
memory/1288-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1288-7-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/3964-6-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/5032-5-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download