Analysis Overview
SHA256
6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20
Threat Level: Known bad
The file AA_v3.5.exe was found to be: Known bad.
Malicious Activity Summary
Ammyyadmin family
FlawedAmmyy RAT
AmmyyAdmin payload
Checks computer location settings
Drops file in System32 directory
System Location Discovery: System Language Discovery
Suspicious use of FindShellTrayWindow
Modifies data under HKEY_USERS
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-16 16:28
Signatures
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Ammyyadmin family
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-16 16:27
Reported
2024-10-16 16:28
Platform
win7-20240903-en
Max time kernel
32s
Max time network
16s
Command Line
Signatures
FlawedAmmyy RAT
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c6658524c175253e7cbe155a040b36b | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 9025ff084228346ec2fe1d4a5b62843953b240de662f321e9ffcbf58fa13175c3a8a7fe0372d3f8028f87a18bf4a1de25db9fd93afa5a95a321d23c08671de464d0cc6d546f063eda4c12c | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2408 wrote to memory of 2020 | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe |
| PID 2408 wrote to memory of 2020 | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe |
| PID 2408 wrote to memory of 2020 | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe |
| PID 2408 wrote to memory of 2020 | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"
C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe" -service -lunch
C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rl.ammyy.com | udp |
| NL | 188.42.129.148:80 | rl.ammyy.com | tcp |
| DE | 136.243.104.235:443 | tcp |
Files
C:\ProgramData\AMMYY\settings3.bin
| MD5 | 714f2508d4227f74b6adacfef73815d8 |
| SHA1 | a35c8a796e4453c0c09d011284b806d25bdad04c |
| SHA256 | a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480 |
| SHA512 | 1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8 |
C:\ProgramData\AMMYY\hr
| MD5 | 1bf6ea4f1d3e0eaa48c42ffb6be361f9 |
| SHA1 | ed23a4a101d0381c037c2b38173d8f0d5dd90f8c |
| SHA256 | c4393722d7ea2fd0829f221d3f3f83a911bef9145bf687c2beb66fdb7c4b1e67 |
| SHA512 | e94793ee960a46ed5f0e3b1d27d2e82c768503c1a8bb0632418501ce728fb186effa0dc34bc747e02f0be0abf3d710ed9cc689b0d98ca39bab5e9a2ef5a91cc5 |
C:\ProgramData\AMMYY\hr3
| MD5 | 5694c7f4d3fcac1fc3b36c287325b963 |
| SHA1 | 25eda616bd3906d6caf69c3195eb1f4b8de67fd1 |
| SHA256 | 152d7e8584fbca0e8ee210f754e1c6ac5426b39ebd1354bab779634ad08ce1a4 |
| SHA512 | f2a9de9cfe38480baafe6c2f92972a96ba5b00791c10cb54b48e3d570858b1e1796cca8645003e04c84b67e51f98f48824ef24bb691db6bf22581961e0dcc907 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-16 16:27
Reported
2024-10-16 16:30
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
151s
Command Line
Signatures
FlawedAmmyy RAT
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Ammyy | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253ff658454a040b36b | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 1ed671398d53818827c9418cf8730d30591e6871628833f6f27aecc141060ac7d0c68963013428b0a0414db6b29ff18c7bc548aa6986be5bdbd25ea98a58971c272200ca80cc918ec4a62a | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3048 wrote to memory of 3760 | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe |
| PID 3048 wrote to memory of 3760 | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe |
| PID 3048 wrote to memory of 3760 | N/A | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe | C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"
C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe" -service -lunch
C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rl.ammyy.com | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| NL | 188.42.129.148:80 | rl.ammyy.com | tcp |
| DE | 136.243.104.235:443 | tcp | |
| US | 8.8.8.8:53 | 148.129.42.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 235.104.243.136.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp |
Files
C:\ProgramData\AMMYY\settings3.bin
| MD5 | 714f2508d4227f74b6adacfef73815d8 |
| SHA1 | a35c8a796e4453c0c09d011284b806d25bdad04c |
| SHA256 | a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480 |
| SHA512 | 1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8 |
C:\ProgramData\AMMYY\hr
| MD5 | b781a14f43a22fcd08570daf18f2dcd3 |
| SHA1 | 81ba1af9238b36fe0dddd020a53998019a83366b |
| SHA256 | 5fc3f08f43bfb907f0becc4dc1623d3af77f38e2671d574c34249ecfa51d8359 |
| SHA512 | 1e5095c123fae71c4fd8db5d72986c41fa19310dd644eb2758a802094c99eda398051f857234b20215195d70341ea6871cc08657f720264e377487fe402e916d |
C:\ProgramData\AMMYY\hr3
| MD5 | 4fc4145bc6589439a7f95a6166271c75 |
| SHA1 | 42e8dd66020edb182ea13d3f97c7dc7b5822615d |
| SHA256 | e9395cc06059cc4dce91260f3250e50b71a3a8a9624b305328967b977c6d855f |
| SHA512 | 8b76764857766b10a69f231c5d6422cd86115151a8d56cb5fcba72b8f3b6353d100096de4edd5e6d311393274c7059d14904f657dd8098cbbedcda3c82d63c6d |