flawedammyy | 6ddf8848d96bfa5ec09d25b0b1deabf683940f455a166dc4440e4b758c6cf1eb

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 22:41

Target

dll/UzakYardim.exe
Size

740KB
MD5

10a524d7ac94678ae286b065421647db
SHA1

b538e3f113817c8237419310ef47817d1d961fa9
SHA256

55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
SHA512

928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
SSDEEP

12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy

Score

10^/10

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

Processes:

UzakYardim.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	UzakYardim.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	UzakYardim.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	UzakYardim.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	UzakYardim.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

UzakYardim.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	UzakYardim.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c69585c401452531487c265aaf8b26b	UzakYardim.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 0914caf5014c4387d679d51f4b6ef34ad060dd82ea4299405a8708463d4566dd5014ed1449583b1e40f29c2250fc92879931259d40d3c04e61a0e407d6739ff95b423b8a	UzakYardim.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	UzakYardim.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	UzakYardim.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

UzakYardim.exe

pid process

4688 UzakYardim.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

UzakYardim.exe

pid process

4688 UzakYardim.exe

pid	process
4688	UzakYardim.exe

pid	process
4688	UzakYardim.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

UzakYardim.exe

description	pid	process	target process
PID 4356 wrote to memory of 4688	4356	UzakYardim.exe	UzakYardim.exe
PID 4356 wrote to memory of 4688	4356	UzakYardim.exe	UzakYardim.exe
PID 4356 wrote to memory of 4688	4356	UzakYardim.exe	UzakYardim.exe

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
1⤵
PID:3936

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
  "C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4688

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
571d57aaa912df2ce583f49f7b77abc3

SHA1
15d6ced521f04377732182216e8258a6efd19cf1

SHA256
757b502f91e43ae968ae70261b39a1b575e6ba69c13a2a9195148e72d72d95c1

SHA512
d5cccc27cf29d5eab65e88611cf6521251b6370159ae5ba6a89774071ef7f591c4ab8510f0b169604cf51c6820caada5be313a3231e8f0c3e377289c7cbd982f

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
88bfd54db8cf88d75c9e8b20f6d767d2

SHA1
e743601bc2f6587c41aa37f22188079f2f03f32b

SHA256
b0184c1bbb2fae8ead017cafd110615e12724095e78477f7349ad5cde3798ac9

SHA512
6e31f6e452197517dbab736782cae8d7834d6ba4b3ad598b8b0be74d1277b6303029cdeb27984e931dc90c82a8e1f2475c27c07da4f14b2421d4e4d43dbc3e6a

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
331B

MD5
c5b80443bc31f2f5c1d2e384c3b82961

SHA1
445a99fa06484d216276b9284eedf25483780216

SHA256
cc8225e7412000f34a92f118af842d585d575498f36fe772dedad9f88c1fe5ad

SHA512
eae9247b9a1abbf8822ce65dbfd2db9b59a57367c7885614b89b8608688753e0c71fc8c955eb1493ef4dd7ba952760ff3476e05d9c177fb40661765a9e408d97

Download Submit