ammyyadmin | 38ff85361dc445ac994c4bc8c6e89519c36f008b6f19302e0ac499f2781d0444

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38ff85361dc445ac994c4bc8c6e89519c36f008b6f19302e0ac499f2781d0444.exe
Size

6.0MB
MD5

6295023432781172352bab3cf4fefa66
SHA1

81122ddba7ec71f0e0bedfefaf52c68acf3c8001
SHA256

38ff85361dc445ac994c4bc8c6e89519c36f008b6f19302e0ac499f2781d0444
SHA512

5de2b4117b3000b75eec16c4294cf38f50e150d24f56291c9cb50b5d02053a4cba22069fb6662525242d5db182343b2611123f18865e736f9e8fc3f5ab3f6dd3
SSDEEP

49152:Ui+FVneyWnnqDGNyWhCSoPM1xlZVD227tNStll0Xhgzq7HM8rXFT44aSlxYlBit:Ui26q94jJR7tNmlKg8rHa65

Score

10^/10

ammyyadmin discovery rat upx

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2520-0-0x0000000000400000-0x0000000000A08000-memory.dmp	family_ammyyadmin
behavioral1/memory/2520-2-0x0000000000400000-0x0000000000A08000-memory.dmp	family_ammyyadmin

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2520-0-0x0000000000400000-0x0000000000A08000-memory.dmp	upx
behavioral1/memory/2520-2-0x0000000000400000-0x0000000000A08000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

38ff85361dc445ac994c4bc8c6e89519c36f008b6f19302e0ac499f2781d0444.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38ff85361dc445ac994c4bc8c6e89519c36f008b6f19302e0ac499f2781d0444.exe

C:\Users\Admin\AppData\Local\Temp\38ff85361dc445ac994c4bc8c6e89519c36f008b6f19302e0ac499f2781d0444.exe
"C:\Users\Admin\AppData\Local\Temp\38ff85361dc445ac994c4bc8c6e89519c36f008b6f19302e0ac499f2781d0444.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-1-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2520-0-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/2520-2-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/2520-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download