flawedammyy | efa1fccd69461c3ae5553242b593b5ec123339757287c45280a24f685cfe041e

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AA_v3.exe
Size

778KB
MD5

121e1634bf18768802427f0a13f039a9
SHA1

8868654ba10fb4c9a7bd882d1f947f4fd51e988e
SHA256

5fc600351bade74c2791fc526bca6bb606355cc65e5253f7f791254db58ee7fa
SHA512

393df326af3109fe701b579b73f42f7a9b155bb4df6ea7049ad3ae9fdd03446576b887a99eb7a0d59949a7a63367e223253448b6f1a0ebeaf358fa2873dcc200
SSDEEP

12288:hSX+EvrCA3FNIs34Zk1L1ZSNlm3Spsal6lbRtMuStGKcsCSqcl90Va1ugp:2FNN4Zk1LTclm3e1kbRtyGKcpHcl517p

Score

10^/10

flawedammyy discovery trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Blocklisted process makes network request 1 IoCs

flow	pid	Process
49	4172	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	AA_v3.exe

Loads dropped DLL 1 IoCs

pid	Process
4172	rundll32.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\34B6AF881B9D738561FC099B83DF3A01	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\34B6AF881B9D738561FC099B83DF3A01	AA_v3.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 643f976e5d8dd6480a77fdf497e6c7a1cee2d200703d38b2c183e753fc51bc495dad9fa96ea4e6bf806e373b47083ff912342559cbcbb924b284e091be22bf1eb4a064e10bc2c69137537b	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AA_v3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA_v3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe
4172	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4172	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5016	AA_v3.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5016	AA_v3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 5016	3644	AA_v3.exe	84
PID 3644 wrote to memory of 5016	3644	AA_v3.exe	84
PID 3644 wrote to memory of 5016	3644	AA_v3.exe	84
PID 5016 wrote to memory of 4172	5016	AA_v3.exe	100
PID 5016 wrote to memory of 4172	5016	AA_v3.exe	100

C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1428

C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
  "C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"
  2⤵
  - Checks computer location settings
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SYSTEM32\rundll32.exe
    rundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
C:\ProgramData\AMMYY\aa_nts.log

Filesize
4KB

MD5
e21eb5d54f43d993a95df1c7b778514f

SHA1
0a5f33b12ae432c54756570bf4c63d84d3eb5962

SHA256
071040a51ae71240c14bc3036e03c04ed10c6d301c458bd26a9d7473b4b235dd

SHA512
510a5030c37078980ff48d1ffc8f6a2f1147f62f88a610706f12c68b40139e416527d9af009e07e7c739cd7de58d1531514cbd94ca51c122728975fe03727704

Download Submit
C:\ProgramData\AMMYY\aa_nts.msg

Filesize
45B

MD5
0ab38d88f71092c69f4dd2ebee87f81d

SHA1
3afa9ecd2a0e95b344a5ac5b2719dce0b9f8f6a9

SHA256
87248c17211589f790fc8db8bb15d246deacd1e254e96199e86ca2958e77a307

SHA512
1d87efe84241c6eeffa142f5978eea9a86bf74729ec3fc60f964c98a76b8293216f3f70cbb3b9d3d4e0dd1903400bdc55e39910cde0c2293e568c07d8bcd7c8e

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
282B

MD5
ac7221c691ef0a93dbbb5bee6efcb7ec

SHA1
54f197fef16badefb4bf0d7339f6bd1099e505da

SHA256
b6b033b71d3f7f92986e32a61b3244b9856e82a9c3d233696a0dfa29a517106f

SHA512
226299ab1b7b388473163f4fecc41d536755586b4c275475128c5e5946554cd9ca69df223469130d85516f2ac2330a2cb35dec2879355ea0186b63d8429dcd6b

Download Submit
memory/4172-17-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/4172-39-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/4172-57-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/4172-74-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/4172-90-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/4172-107-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/4172-123-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download
memory/4172-140-0x0000000064200000-0x00000000642EE000-memory.dmp

Filesize
952KB

Download