Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 22:59
Behavioral task
behavioral1
Sample
AA_v3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AA_v3.exe
Resource
win10v2004-20241007-en
General
-
Target
AA_v3.exe
-
Size
798KB
-
MD5
90aadf2247149996ae443e2c82af3730
-
SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502
-
SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
-
SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
-
SSDEEP
24576:Uj0JJ4p/A4npt3XojeQG5EtzRtO7GvmDguXd:UjoJ4u4zojegylDN
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 62 4400 rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation AA_v3.exe -
Loads dropped DLL 1 IoCs
pid Process 4400 rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 AA_v3.exe File opened for modification \??\PhysicalDrive0 AA_v3.exe -
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A82946818BB0433A7DC1AFD2189B16AF AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A82946818BB0433A7DC1AFD2189B16AF AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 AA_v3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content AA_v3.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA_v3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA_v3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA_v3.exe -
Modifies data under HKEY_USERS 11 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin AA_v3.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE AA_v3.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AA_v3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy AA_v3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin AA_v3.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 0e20479b574d4387d6b10be39c309db7e9c4bda57eaf154a5d5da214d2128e843cbf07ec51144691b60741dc5be5352f3c354e1f65e5a7ddc34ff04ea60247d20201545eaa72aed9e6ceb9 AA_v3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AA_v3.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AA_v3.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AA_v3.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AA_v3.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing AA_v3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe 4400 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLockMemoryPrivilege 4400 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5044 AA_v3.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5044 AA_v3.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2416 wrote to memory of 5044 2416 AA_v3.exe 85 PID 2416 wrote to memory of 5044 2416 AA_v3.exe 85 PID 2416 wrote to memory of 5044 2416 AA_v3.exe 85 PID 5044 wrote to memory of 4400 5044 AA_v3.exe 95 PID 5044 wrote to memory of 4400 5044 AA_v3.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:964
-
C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe" -service -lunch1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902KB
MD5480a66902e6e7cdafaa6711e8697ff8c
SHA16ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA2567eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA5127d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5
-
Filesize
4KB
MD5bc8c0a28430600d890b4a2ddde1c9230
SHA18576cf690808df2619edb40071eaa2dcd7a45320
SHA25602aac19a9f27ac2dabef0f6698f6a81b8001d7143b86957ba0581ff6d582d279
SHA512c80885f18626000001109340deb96cb647e8fc9f9674e2090f96a63b0c981e448bcbf8136ca6839d5b853187096895ee821b983510aef5a6a64ed790bf1157f4
-
Filesize
46B
MD576038623e270f399769df67a3ed15c16
SHA1ebf7d7537f45738be48e6f64d59c846b13fb4334
SHA2564dbdf4f709d50f9521e92ce5f7d4f305e2384bcda387fb2b325ff17d205bb687
SHA512a5316694d844e5b10c589f58fdf65645568b3909b2914f85c99195f9625e4124f787bc0980cff98f1e8289ff84824620a03f32cdab18e5bbcb2e59b33f397aec
-
Filesize
334B
MD56aec24af5032b2728bec153b6a5d76bb
SHA1d569068bd756e2dbead56d477e1d985e32aacb28
SHA25659e10f308c4dbf5db4d5d349f29f4ca9ce902a8193f37436d3056eaced04f94e
SHA512f40c5f61043959d4893f25f4c74afdda59d380c64d5de60a1a8f457845c847c99311c3f40417b82b2096a078af6cbd17cba9da991218dd1e1a538f393b029c5b