ammyyadmin | abdfad0c57f3e708ebcc12b3c829baf4f8d8dc8a26a4e3753bc2e5b7a2a26d8c

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 04:23

Target

3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe
Size

993KB
MD5

3ddd87914b03464dec7ce22534e9e779
SHA1

099d3432b497f56d34a41832e7c21a4b155f6e5b
SHA256

abdfad0c57f3e708ebcc12b3c829baf4f8d8dc8a26a4e3753bc2e5b7a2a26d8c
SHA512

00982884fff0fe650bfffe26fb98d74004acf709a0300622040f0ea2ab357f57584da8f2d31a7547b7062356ececd616902cb6dc600e02a005f17cd64589fca2
SSDEEP

24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxD:dJ5gEKNikf3hBfUiWxD

Score

10^/10

ammyyadmin rat

AmmyyAdmin payload 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\budha.exe	family_ammyyadmin

Executes dropped EXE 1 IoCs

Processes:

budha.exe

pid process

2116 budha.exe
Loads dropped DLL 1 IoCs

Processes:

3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe

pid process

2456 3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2116	budha.exe

pid	process
2456	3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe

description	pid	process	target process
PID 2456 wrote to memory of 2116	2456	3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe	budha.exe
PID 2456 wrote to memory of 2116	2456	3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe	budha.exe
PID 2456 wrote to memory of 2116	2456	3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe	budha.exe
PID 2456 wrote to memory of 2116	2456	3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe	budha.exe

C:\Users\Admin\AppData\Local\Temp\budha.exe
"C:\Users\Admin\AppData\Local\Temp\budha.exe"
2⤵
- Executes dropped EXE
PID:2116

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
994KB

MD5
6fe20a0b2410f95b32a133999177f893

SHA1
23e60431999505fc6add7fbe7dda780faf8bdbfd

SHA256
054b09569289c34aa180a9943dcda0d71667160be4c4b14432140bcc5dc6fc09

SHA512
41c5be008cea38a4e8513bc28fec13c745e106620a3df4d0c2ee7b289c69b9e7d8507bddf2c3fcc3843a570037753ab5a600c2d0c3f1074acf4fc870f8294e72

Download Submit
memory/2116-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2116-14-0x0000000002750000-0x0000000002B50000-memory.dmp

Filesize
4.0MB

Download
memory/2116-13-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/2116-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2456-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2456-2-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/2456-3-0x0000000002780000-0x0000000002B80000-memory.dmp

Filesize
4.0MB

Download
memory/2456-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download