ammyyadmin | 432b8efe51e51b684307ef832bde5a3620aefad51d5ec33a561a5eb3cf5569c5

General

Target

644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Size

705KB
MD5

644458de4a05f93d6d55e5e896926036
SHA1

0cd0d998db4fe3f37458ac69aeb0e19783d3166d
SHA256

432b8efe51e51b684307ef832bde5a3620aefad51d5ec33a561a5eb3cf5569c5
SHA512

4d1014c13538b2d05788e4c50421790e3c5e0d2c3a43262145c45b83e74f4e8fecdcfc050ad6ae06a1a762df5f267d654a1b8990676291327cfcfafee9b656f9
SSDEEP

12288:Rhjun1eaHjs7C8la0n9lp9Dkb1RtgA93ykM+TZtC3lgk:vqeOs7C840n9lpG1Rtb93IKZtfk

Score

10^/10

ammyyadmin flawedammyy rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 4 IoCs

resource	yara_rule
behavioral1/memory/2164-0-0x0000000000400000-0x00000000004C7000-memory.dmp	family_ammyyadmin
behavioral1/memory/968-5-0x0000000000400000-0x00000000004C7000-memory.dmp	family_ammyyadmin
behavioral1/memory/2164-8-0x0000000000400000-0x00000000004C7000-memory.dmp	family_ammyyadmin
behavioral1/memory/1760-6-0x0000000000400000-0x00000000004C7000-memory.dmp	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\International\Geo\Nation	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c695f594c16545377d3ae232c83b26b	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = bb419e146a3d1bd13add6f74f792380935cb787e8b8558b059dd60b2da38f1eabdd7394ea72657cb5d08422b813855b1ae525d054217b27074242315675e364ffdb6a4db	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
968	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
968	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 968	1760	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe	30
PID 1760 wrote to memory of 968	1760	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe	30
PID 1760 wrote to memory of 968	1760	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe	30
PID 1760 wrote to memory of 968	1760	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe"
1⤵
PID:2164

C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
40bb1a3d7b39bf684a24a24a884a497f

SHA1
478a520a9c4c9a4a3c11b9b987e1bb5c03da7161

SHA256
c02bb4a5e85b5d3ab19146b822b1dfe91634fa951863662e4bf464e0e6a99f3d

SHA512
93a042360aabc50f4e0acfcbed16f890efa2114d118a7c159e331dc08ed64e65a4261226643ff51dbfd33dd934c9c30cad30e8dc4a49305bf9a65fd38ba3cb8a

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
b4486fef2458b50934bf92ab23221d1c

SHA1
416481645e0ea8462171514c1a97d73707876463

SHA256
dd8a9595e9477ced29c8e2f59705906222946ef27637b33b09b71b97c6d3b191

SHA512
f19bd8b2e22787605fee6814ef88f612e7edafcd006e716fcfec576c3f4fe1de50a6586ba03500f452d98c02ba11c8f38ae3b4309f854c1473bd85264dcad613

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit
memory/968-5-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1760-4-0x0000000000C20000-0x0000000000CE7000-memory.dmp

Filesize
796KB

Download
memory/1760-6-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2164-0-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2164-8-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing