Malware Analysis Report

2024-10-24 20:53

Sample ID 241016-tykwgazaja
Target AA_v3.5.exe
SHA256 6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20
Tags
ammyyadmin flawedammyy discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20

Threat Level: Known bad

The file AA_v3.5.exe was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy discovery trojan

Ammyyadmin family

FlawedAmmyy RAT

AmmyyAdmin payload

Checks computer location settings

Drops file in System32 directory

System Location Discovery: System Language Discovery

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 16:28

Signatures

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A

Ammyyadmin family

ammyyadmin

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 16:27

Reported

2024-10-16 16:28

Platform

win7-20240903-en

Max time kernel

32s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"

Signatures

FlawedAmmyy RAT

trojan flawedammyy

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c6658524c175253e7cbe155a040b36b C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 9025ff084228346ec2fe1d4a5b62843953b240de662f321e9ffcbf58fa13175c3a8a7fe0372d3f8028f87a18bf4a1de25db9fd93afa5a95a321d23c08671de464d0cc6d546f063eda4c12c C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe

"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe

"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe" -service -lunch

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe

"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.235:443 tcp

Files

C:\ProgramData\AMMYY\settings3.bin

MD5 714f2508d4227f74b6adacfef73815d8
SHA1 a35c8a796e4453c0c09d011284b806d25bdad04c
SHA256 a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480
SHA512 1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

C:\ProgramData\AMMYY\hr

MD5 1bf6ea4f1d3e0eaa48c42ffb6be361f9
SHA1 ed23a4a101d0381c037c2b38173d8f0d5dd90f8c
SHA256 c4393722d7ea2fd0829f221d3f3f83a911bef9145bf687c2beb66fdb7c4b1e67
SHA512 e94793ee960a46ed5f0e3b1d27d2e82c768503c1a8bb0632418501ce728fb186effa0dc34bc747e02f0be0abf3d710ed9cc689b0d98ca39bab5e9a2ef5a91cc5

C:\ProgramData\AMMYY\hr3

MD5 5694c7f4d3fcac1fc3b36c287325b963
SHA1 25eda616bd3906d6caf69c3195eb1f4b8de67fd1
SHA256 152d7e8584fbca0e8ee210f754e1c6ac5426b39ebd1354bab779634ad08ce1a4
SHA512 f2a9de9cfe38480baafe6c2f92972a96ba5b00791c10cb54b48e3d570858b1e1796cca8645003e04c84b67e51f98f48824ef24bb691db6bf22581961e0dcc907

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 16:27

Reported

2024-10-16 16:30

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"

Signatures

FlawedAmmyy RAT

trojan flawedammyy

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253ff658454a040b36b C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 1ed671398d53818827c9418cf8730d30591e6871628833f6f27aecc141060ac7d0c68963013428b0a0414db6b29ff18c7bc548aa6986be5bdbd25ea98a58971c272200ca80cc918ec4a62a C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe

"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe

"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe" -service -lunch

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe

"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rl.ammyy.com udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.235:443 tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 235.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

C:\ProgramData\AMMYY\settings3.bin

MD5 714f2508d4227f74b6adacfef73815d8
SHA1 a35c8a796e4453c0c09d011284b806d25bdad04c
SHA256 a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480
SHA512 1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

C:\ProgramData\AMMYY\hr

MD5 b781a14f43a22fcd08570daf18f2dcd3
SHA1 81ba1af9238b36fe0dddd020a53998019a83366b
SHA256 5fc3f08f43bfb907f0becc4dc1623d3af77f38e2671d574c34249ecfa51d8359
SHA512 1e5095c123fae71c4fd8db5d72986c41fa19310dd644eb2758a802094c99eda398051f857234b20215195d70341ea6871cc08657f720264e377487fe402e916d

C:\ProgramData\AMMYY\hr3

MD5 4fc4145bc6589439a7f95a6166271c75
SHA1 42e8dd66020edb182ea13d3f97c7dc7b5822615d
SHA256 e9395cc06059cc4dce91260f3250e50b71a3a8a9624b305328967b977c6d855f
SHA512 8b76764857766b10a69f231c5d6422cd86115151a8d56cb5fcba72b8f3b6353d100096de4edd5e6d311393274c7059d14904f657dd8098cbbedcda3c82d63c6d