flawedammyy | a396d3f96540a75df6cc663945667551822d6f33259f87dc6b4a369cfa858649

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 10:05

Target

dll/UzakYardim.exe
Size

740KB
MD5

10a524d7ac94678ae286b065421647db
SHA1

b538e3f113817c8237419310ef47817d1d961fa9
SHA256

55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4
SHA512

928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b
SSDEEP

12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy

Score

10^/10

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

Processes:

UzakYardim.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	UzakYardim.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	UzakYardim.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	UzakYardim.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	UzakYardim.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

UzakYardim.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	UzakYardim.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	UzakYardim.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	UzakYardim.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	UzakYardim.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c69585c401452535f398f1dc3f1b26b	UzakYardim.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 496dcb6a27fee49775d16d5780ad855fd3c1e7b630aaa79449b04fd707c4b4a3baec3a19c87668b6e93af60c01eabf768126b2579e266f3cb2d8ef4261b2d45f1efd1916	UzakYardim.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

UzakYardim.exe

pid process

4064 UzakYardim.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

UzakYardim.exe

pid process

4064 UzakYardim.exe

pid	process
4064	UzakYardim.exe

pid	process
4064	UzakYardim.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

UzakYardim.exe

description	pid	process	target process
PID 1432 wrote to memory of 4064	1432	UzakYardim.exe	UzakYardim.exe
PID 1432 wrote to memory of 4064	1432	UzakYardim.exe	UzakYardim.exe
PID 1432 wrote to memory of 4064	1432	UzakYardim.exe	UzakYardim.exe

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
1⤵
PID:4788

C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
"C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
  "C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4064

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
d4c4cc2b81c36523783b845d7f62f2cf

SHA1
1f1ec8fc0d2b5f5a824d5d092d8ae828fb1e0bfe

SHA256
50806698bd7bbe30b5421cd041df47334b250134619f9faa90f8e7ba2cad2c69

SHA512
6f709816dcd371f01b3baef88fbdf0cd42e8b91f28c51c94c1c98adbd414317b6ea9de11728c1f79ca9db85447ad8032a5a3c9fb2c3f72239e60606a3a9e9398

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
5ee454c9bd5eb9b896f25dacd223cd1b

SHA1
98c843e0e7f81b8cb485c31cf812cb311ffa0dfc

SHA256
4771cc45ec62fc04f16d84b3765015622b4a074626b802a19a7adcce73c02137

SHA512
abb9d3e9276616c086590b7f3a51419e29a5749814d174926749f7e1c1f21a7eeb550b4412151536bad442f4ed0f252821ff3f024de89e0512a5b409ca9e7b55

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
331B

MD5
c5b80443bc31f2f5c1d2e384c3b82961

SHA1
445a99fa06484d216276b9284eedf25483780216

SHA256
cc8225e7412000f34a92f118af842d585d575498f36fe772dedad9f88c1fe5ad

SHA512
eae9247b9a1abbf8822ce65dbfd2db9b59a57367c7885614b89b8608688753e0c71fc8c955eb1493ef4dd7ba952760ff3476e05d9c177fb40661765a9e408d97

Download Submit