ammyyadmin | abdfad0c57f3e708ebcc12b3c829baf4f8d8dc8a26a4e3753bc2e5b7a2a26d8c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe
Size

993KB
MD5

3ddd87914b03464dec7ce22534e9e779
SHA1

099d3432b497f56d34a41832e7c21a4b155f6e5b
SHA256

abdfad0c57f3e708ebcc12b3c829baf4f8d8dc8a26a4e3753bc2e5b7a2a26d8c
SHA512

00982884fff0fe650bfffe26fb98d74004acf709a0300622040f0ea2ab357f57584da8f2d31a7547b7062356ececd616902cb6dc600e02a005f17cd64589fca2
SSDEEP

24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxD:dJ5gEKNikf3hBfUiWxD

Score

10^/10

ammyyadmin rat

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\budha.exe	family_ammyyadmin

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

budha.exe

pid process

2052 budha.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2052	budha.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe

description	pid	process	target process
PID 4016 wrote to memory of 2052	4016	3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe	budha.exe
PID 4016 wrote to memory of 2052	4016	3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe	budha.exe
PID 4016 wrote to memory of 2052	4016	3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe	budha.exe

C:\Users\Admin\AppData\Local\Temp\3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ddd87914b03464dec7ce22534e9e779_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\budha.exe
"C:\Users\Admin\AppData\Local\Temp\budha.exe"
2⤵
- Executes dropped EXE
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
994KB

MD5
6fe20a0b2410f95b32a133999177f893

SHA1
23e60431999505fc6add7fbe7dda780faf8bdbfd

SHA256
054b09569289c34aa180a9943dcda0d71667160be4c4b14432140bcc5dc6fc09

SHA512
41c5be008cea38a4e8513bc28fec13c745e106620a3df4d0c2ee7b289c69b9e7d8507bddf2c3fcc3843a570037753ab5a600c2d0c3f1074acf4fc870f8294e72

Download Submit
memory/2052-13-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2052-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4016-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4016-2-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/4016-3-0x0000000002570000-0x0000000002970000-memory.dmp

Filesize
4.0MB

Download
memory/4016-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download