Analysis Overview
SHA256
0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63
Threat Level: Known bad
The file 0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63 was found to be: Known bad.
Malicious Activity Summary
AmmyyAdmin payload
Flawedammyy family
Ammyyadmin family
Ammyy Admin
FlawedAmmyy RAT
Checks computer location settings
Drops file in System32 directory
System Location Discovery: System Language Discovery
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-24 19:19
Signatures
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Ammyyadmin family
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-24 19:19
Reported
2024-12-24 19:22
Platform
win7-20240903-en
Max time kernel
150s
Max time network
146s
Command Line
Signatures
Ammyy Admin
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Ammyyadmin family
FlawedAmmyy RAT
Flawedammyy family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 07e3d7760fdf70ff545e4c5532cce14b15b8d8cbbf00395c4d77677ffdff5ca6f33a730b63a77a07ad31903e7922cf5414d5026af75fa68c3dc78b249fad1c492483f463c2ceec9090b7ba | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe
"C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe"
C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe
"C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe" -service -lunch
C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe
"C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rl.ammyy.com | udp |
| NL | 188.42.129.148:80 | rl.ammyy.com | tcp |
| DE | 136.243.104.235:443 | tcp |
Files
memory/2536-0-0x0000000000400000-0x00000000004D5000-memory.dmp
C:\ProgramData\AMMYY\settings3.bin
| MD5 | bcc40b676c5b0f5a176be92cc8f4199f |
| SHA1 | 5415364e6ab90151eb1272268cb75ef6c4306a2f |
| SHA256 | d3df407118bd28d28e7d3c8afc497c5e478e5d078f7792501ddecb45f3b51826 |
| SHA512 | 467c473be5b9f6e0b8302620b6fbd9ad84f90da2bae3247d8326a22bfdd902fd79e55a2160493903eb747db6ef38fc9decb3db372afa26667f374ca2d0ceb36d |
memory/1640-3-0x0000000000400000-0x00000000004D5000-memory.dmp
memory/2536-4-0x0000000000400000-0x00000000004D5000-memory.dmp
memory/2068-6-0x0000000000400000-0x00000000004D5000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-24 19:19
Reported
2024-12-24 19:22
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
151s
Command Line
Signatures
Ammyy Admin
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Ammyyadmin family
FlawedAmmyy RAT
Flawedammyy family
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Ammyy | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 03124f9d554e1a9695d92e5261aef73160acf9137dbf1f75892187eaa2ce6fc91a791a2b1b799a33c55161323ef8407e83a51ba97ce7d25eab0ce68dc1d5b6a50c7e6fefca4bff7202c7d5 | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3424 wrote to memory of 3452 | N/A | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe |
| PID 3424 wrote to memory of 3452 | N/A | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe |
| PID 3424 wrote to memory of 3452 | N/A | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe | C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe
"C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe"
C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe
"C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe" -service -lunch
C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe
"C:\Users\Admin\AppData\Local\Temp\0650de7f9dcb04f405921fe352a1076b70eea701423806badf1f647e5c88ee63.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | rl.ammyy.com | udp |
| NL | 188.42.129.148:80 | rl.ammyy.com | tcp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 148.129.42.188.in-addr.arpa | udp |
| DE | 136.243.104.235:443 | tcp | |
| US | 8.8.8.8:53 | 235.104.243.136.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.116.69.13.in-addr.arpa | udp |
Files
memory/2884-0-0x0000000000400000-0x00000000004D5000-memory.dmp
memory/3424-3-0x0000000000400000-0x00000000004D5000-memory.dmp
C:\ProgramData\AMMYY\settings3.bin
| MD5 | bcc40b676c5b0f5a176be92cc8f4199f |
| SHA1 | 5415364e6ab90151eb1272268cb75ef6c4306a2f |
| SHA256 | d3df407118bd28d28e7d3c8afc497c5e478e5d078f7792501ddecb45f3b51826 |
| SHA512 | 467c473be5b9f6e0b8302620b6fbd9ad84f90da2bae3247d8326a22bfdd902fd79e55a2160493903eb747db6ef38fc9decb3db372afa26667f374ca2d0ceb36d |
memory/2884-4-0x0000000000400000-0x00000000004D5000-memory.dmp
memory/3452-6-0x0000000000400000-0x00000000004D5000-memory.dmp