ammyyadmin | d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5e

Analysis

max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5eN.exe
Size

1013KB
MD5

d64b1982a74b76baff2ea716f543c250
SHA1

c7cb1c0b7686def8168f42af3cd7a9ce526a0372
SHA256

d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5e
SHA512

b504b363c952221317365f52a72875c2b4b3eba0d12e23e311595eb8917c359369da23a49511cab919a8f2363219e7dc69c100d496cb0f3323d2df4065fd4e54
SSDEEP

24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxc:7J5gEKNikf3hBfUiWxc

Score

10^/10

ammyyadmin discovery rat upx

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023c8d-7.dat	family_ammyyadmin

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5eN.exe

Executes dropped EXE 1 IoCs

pid	Process
2976	budha.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1364-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/files/0x0008000000023c8d-7.dat	upx
behavioral2/memory/1364-11-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/2976-20-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	budha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5eN.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2976	1364	d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5eN.exe	87
PID 1364 wrote to memory of 2976	1364	d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5eN.exe	87
PID 1364 wrote to memory of 2976	1364	d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5eN.exe	87

C:\Users\Admin\AppData\Local\Temp\d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5eN.exe
"C:\Users\Admin\AppData\Local\Temp\d8829f7135eba7a5c35870333582733a5a586d354a82490b69bf1e772118dc5eN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\budha.exe
  "C:\Users\Admin\AppData\Local\Temp\budha.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\budha.exe

Filesize
1013KB

MD5
ee3b582d0417f60ae2c5e4e528e7f933

SHA1
5e5835b4fac48e13e737357b3666ae8e80a62e9d

SHA256
7de886032660d9144c47904340553c573ddd81edc13e60b3f2e7c47b0e43090b

SHA512
1dad8c6de72df0afa2fd4f07bfc51e5a830f2f7a23c2ee1180d80042b267f38778704bddd22227088d7a2c9c306d1f777b1e839cf224b72d585fa962b11cc690

Download Submit
memory/1364-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1364-1-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1364-3-0x00000000026B0000-0x0000000002AB0000-memory.dmp

Filesize
4.0MB

Download
memory/1364-11-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2976-12-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/2976-13-0x0000000002570000-0x0000000002970000-memory.dmp

Filesize
4.0MB

Download
memory/2976-20-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download