ammyyadmin | f562ae4ac6fb307a2e3d0e8ab5af0ac38c3ed238e792550df6d09e0071b8ec55

Analysis

max time kernel
142s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe
Size

956KB
MD5

d260bab3f77e21df19a76ff9d9795d50
SHA1

f22e0cbc2d344fbd19b12d02320881e53d9e251f
SHA256

f562ae4ac6fb307a2e3d0e8ab5af0ac38c3ed238e792550df6d09e0071b8ec55
SHA512

287b533ceae2a2c4a3f3a4a1e537dce9c0137789faa057f822d43b05304704f2d798c9b6df05cb3308c815228a86670273354c9d5c07941c3902946fd66972ff
SSDEEP

24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxE:dJ5gEKNikf3hBfUiWxE

Score

10^/10

ammyyadmin rat

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000233da-7.dat	family_ammyyadmin

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2696	budha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2696	4568	d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe	85
PID 4568 wrote to memory of 2696	4568	d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe	85
PID 4568 wrote to memory of 2696	4568	d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d260bab3f77e21df19a76ff9d9795d50_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
957KB

MD5
52f7c7d187eaa445ba5f50ec1e2568fa

SHA1
f1e11e6d056eb8e56fc47eddee751e5176211dd6

SHA256
31e41036ee1bc8018fe9554a583f0758c3d776750d191e9596a581f67f9d11ce

SHA512
008090086f1239fdaeb2406030bfcb629293bacda76efef2e9b0611cb2db387f0e984f6deb88b5dcd6bb473ed3ec31b30881a798f9867ec17dfa5329c854e52c

Download Submit
memory/2696-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2696-14-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/2696-15-0x0000000002570000-0x0000000002970000-memory.dmp

Filesize
4.0MB

Download
memory/2696-16-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4568-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4568-1-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4568-3-0x00000000026A0000-0x0000000002AA0000-memory.dmp

Filesize
4.0MB

Download
memory/4568-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download