flawedammyy | 6ddf8848d96bfa5ec09d25b0b1deabf683940f455a166dc4440e4b758c6cf1eb

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dll/UzakYardim.exe
Size

740KB
MD5

10a524d7ac94678ae286b065421647db
SHA1

b538e3f113817c8237419310ef47817d1d961fa9
SHA256

55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
SHA512

928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
SSDEEP

12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UzakYardim.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\International\Geo\Nation	UzakYardim.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

UzakYardim.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	UzakYardim.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c695f594c16545347dd476aaaf8b26b	UzakYardim.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 05d54e5f77c0cf8f4b191a96fc4c3c1f497bd400703d38b2c183e753fc51bc495dad9fa9254cd6eadcf7f11b78bade4b9775b5399a2b6dc422e35e79a8e5bf7263213e3a	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	UzakYardim.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

UzakYardim.exe

pid process

2068 UzakYardim.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

UzakYardim.exe

pid process

2068 UzakYardim.exe

pid	process
2068	UzakYardim.exe

pid	process
2068	UzakYardim.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

UzakYardim.exe

description	pid	process	target process
PID 1592 wrote to memory of 2068	1592	UzakYardim.exe	UzakYardim.exe
PID 1592 wrote to memory of 2068	1592	UzakYardim.exe	UzakYardim.exe
PID 1592 wrote to memory of 2068	1592	UzakYardim.exe	UzakYardim.exe
PID 1592 wrote to memory of 2068	1592	UzakYardim.exe	UzakYardim.exe

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
1⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
2⤵
- Checks computer location settings
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
97e39d00003d2b4633022a3f8e8349b8

SHA1
8cdcf5c1477cca3473f660f2f0504b11f75f69e6

SHA256
bd54bdfc00b1e0f991ffcd5594f9cfe57a9bea042822de5343ba8b118a853d2e

SHA512
ada1e45ec85c6da966bb4358615444317ce3eb090fa3e52651f398b3935351b966de0a74fca6dbc6873c58c26e2bee6952022c980ad94c2ed628a3fc96ac3a04

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
ebc7437de1b804694c4ec9cb26f64c48

SHA1
d27ed40ae1362503c80a0a1cc1d0a030a664a853

SHA256
67ec1a90a4164f4dc1986af9c428dcb6688663db71de1c4cd2ba95374f156b32

SHA512
f45d24e7fdcead5f8d9de3fbf684a99f31a8b9f07f69a22087f86207f4479b0b1d7a324f6c99e06980604828752dd274a51f6d2232fa6ca6b6ee00447e9b10b3

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
331B

MD5
c5b80443bc31f2f5c1d2e384c3b82961

SHA1
445a99fa06484d216276b9284eedf25483780216

SHA256
cc8225e7412000f34a92f118af842d585d575498f36fe772dedad9f88c1fe5ad

SHA512
eae9247b9a1abbf8822ce65dbfd2db9b59a57367c7885614b89b8608688753e0c71fc8c955eb1493ef4dd7ba952760ff3476e05d9c177fb40661765a9e408d97

Download Submit