ammyyadmin | 151a628a945506fa0ed3c1bfd3694fa41d6102840bc5a4466cd9c8fad870e5ff

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa87aa27ca04593fcdd02d5b6f447cdc_JaffaCakes118.exe
Size

1012KB
MD5

aa87aa27ca04593fcdd02d5b6f447cdc
SHA1

70dda7e69acea067cf6ab3ed6ffddc8f39f36d24
SHA256

151a628a945506fa0ed3c1bfd3694fa41d6102840bc5a4466cd9c8fad870e5ff
SHA512

75cd0ec0c76d443a8e778a34d60f42d897c57cf6fa32fe90f5f015ed6d2bdb47831f64000735c68b543c90ffb0adf370f4519cd34f455ede0d1bb2c204e2d5f2
SSDEEP

24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxQ:7J5gEKNikf3hBfUiWxQ

Score

10^/10

ammyyadmin rat upx

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122e4-5.dat	family_ammyyadmin

Executes dropped EXE 1 IoCs

pid	Process
1840	budha.exe

Loads dropped DLL 1 IoCs

pid	Process
2248	aa87aa27ca04593fcdd02d5b6f447cdc_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x000c0000000122e4-5.dat	upx
behavioral1/memory/1840-9-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2248-10-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/1840-14-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1840	2248	aa87aa27ca04593fcdd02d5b6f447cdc_JaffaCakes118.exe	28
PID 2248 wrote to memory of 1840	2248	aa87aa27ca04593fcdd02d5b6f447cdc_JaffaCakes118.exe	28
PID 2248 wrote to memory of 1840	2248	aa87aa27ca04593fcdd02d5b6f447cdc_JaffaCakes118.exe	28
PID 2248 wrote to memory of 1840	2248	aa87aa27ca04593fcdd02d5b6f447cdc_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\aa87aa27ca04593fcdd02d5b6f447cdc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa87aa27ca04593fcdd02d5b6f447cdc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
1012KB

MD5
3ec7371ec0bff65b1e4a60cd01b7f999

SHA1
8f80f02808c2fd81aba79c084754d27aebfa7a77

SHA256
6acc26807f61efe83117d5316cd0d8342357f32bb9a9d8b177ffec4ad1c64700

SHA512
250608423978ca1a68af774d5aa369cc742c4084aa36a6ce033ae4ad83b05c2035f69775eceada1f7b80aa9815076613154dc3e2c3d6db5b01d8814c52fcde0c

Download Submit
memory/1840-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1840-13-0x0000000002B60000-0x0000000002F60000-memory.dmp

Filesize
4.0MB

Download
memory/1840-12-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Filesize
4KB

Download
memory/1840-14-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2248-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2248-2-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2248-3-0x0000000002B00000-0x0000000002F00000-memory.dmp

Filesize
4.0MB

Download
memory/2248-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download