flawedammyy | 68fc88238de071fbdc5f7e1c9771adec1bca2903752f148e6cdb7ea6e796a966

Analysis

max time kernel
153s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dll/UzakYardim.exe
Size

740KB
MD5

10a524d7ac94678ae286b065421647db
SHA1

b538e3f113817c8237419310ef47817d1d961fa9
SHA256

55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
SHA512

928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
SSDEEP

12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation	UzakYardim.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796e5f5e4c105953c7b75c3e00f1b26b	UzakYardim.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 0706c2100c73f2142d875b9e0e2ae64b16e4a79015f1d85018265def1e3d9c20362d2191d75196c8808d35c66e79ef919165933291eb06e7f222d9a234dcd7358263f7d2	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	UzakYardim.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	UzakYardim.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2956	UzakYardim.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2956	2068	UzakYardim.exe	29
PID 2068 wrote to memory of 2956	2068	UzakYardim.exe	29
PID 2068 wrote to memory of 2956	2068	UzakYardim.exe	29
PID 2068 wrote to memory of 2956	2068	UzakYardim.exe	29

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
1⤵
PID:2612

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
  "C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
5da47eefcc49dd016e9fa7531b7aa334

SHA1
dac80c69cc951dc5bfad05d41129be3dc57f8f33

SHA256
ff39e85e46c7dad94d01f72b8599e79d8ca8c38d6c7ef7ccd7c166b0714cbce4

SHA512
d0f291a88012d8d80a2135b785cc5869ba55c14d84ad8ecd358ee174a37a0dd82a8be341fc80ebaf0cb50af0126fc04ceae817b4a29a92282de51d86bc200fd6

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
acda0d0f37b743ba8d999656a7e77834

SHA1
410d430c641eaeb3be1688bcd69e56e72a590e5f

SHA256
33bdca391caf046094772b044fa364da91dd31ac2bf73ad1b0e637cb6ede7701

SHA512
7ee4693242eda49d36600b28b22abe4ce80dd912e1f60c052494014a27e477bd263a3bcd6abfe149acef4b801566601954789fca4e6ba38f45c74947ba7eb248

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
331B

MD5
c5b80443bc31f2f5c1d2e384c3b82961

SHA1
445a99fa06484d216276b9284eedf25483780216

SHA256
cc8225e7412000f34a92f118af842d585d575498f36fe772dedad9f88c1fe5ad

SHA512
eae9247b9a1abbf8822ce65dbfd2db9b59a57367c7885614b89b8608688753e0c71fc8c955eb1493ef4dd7ba952760ff3476e05d9c177fb40661765a9e408d97

Download Submit