Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 12:06

General

  • Target

    dll/UzakYardim.exe

  • Size

    740KB

  • MD5

    10a524d7ac94678ae286b065421647db

  • SHA1

    b538e3f113817c8237419310ef47817d1d961fa9

  • SHA256

    55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4

  • SHA512

    928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b

  • SSDEEP

    12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy

Score
10/10

Malware Config

Signatures

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
    "C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
    1⤵
      PID:2068
    • C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
      "C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe" -service -lunch
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe
        "C:\Users\Admin\AppData\Local\Temp\dll\UzakYardim.exe"
        2⤵
        • Checks computer location settings
        • Modifies data under HKEY_USERS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2532

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\AMMYY\hr

      Filesize

      22B

      MD5

      b6a4eabbe9ad7c03d8e177c79d51685c

      SHA1

      117086c3b045a5a0880b608a804d7f1b4df9656e

      SHA256

      6d358460ce83bd4603ec718d598beb9081424527a3afdb24d9557505c5730b2d

      SHA512

      91c4c858204066e925647e27fc3c731644fdb406e2568aab8083c059f6afec0b658a4fd92d34435ed61915ed959b00a591fe0bbf35eb702b728253a707ba9dc6

    • C:\ProgramData\AMMYY\hr3

      Filesize

      68B

      MD5

      308c0e29a21e06cfb7f7e33156a916d6

      SHA1

      b1d4d3fa8bdf36f027bc0d2cd98096c23b6dcac5

      SHA256

      2f5f699428733a2ed2dfb63854b442ad3ed93edfae7441bf71dadcdc49bbc7b1

      SHA512

      41f4bd60f2b8c4df4d6d70797e09e8fa69d2bdd282bcebf568f52434d1ce70ab3a650f6ea0664fc35172e146ad72cf5785eda825c2b75542e10636654713948a

    • C:\ProgramData\AMMYY\settings3.bin

      Filesize

      331B

      MD5

      c5b80443bc31f2f5c1d2e384c3b82961

      SHA1

      445a99fa06484d216276b9284eedf25483780216

      SHA256

      cc8225e7412000f34a92f118af842d585d575498f36fe772dedad9f88c1fe5ad

      SHA512

      eae9247b9a1abbf8822ce65dbfd2db9b59a57367c7885614b89b8608688753e0c71fc8c955eb1493ef4dd7ba952760ff3476e05d9c177fb40661765a9e408d97