flawedammyy | 91e4c3aa21da30e0daaf5c918f8e4c9a66ce5aa70bbb8baaf7b9e4ba5faeccaa

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AA_v3.5.exe
Size

751KB
MD5

1fc7c230d6db0d7a0da6f415da271159
SHA1

e0bd10d83bc7b3f1eb628974a8f690ffda6e9351
SHA256

7a836e718b70f586695d1bced9eacfb1aa1b67387b051d0536669754b391fe81
SHA512

96d64cba5bf650066e54bcb84f13aabd1992811963ae2dd3530431e86bbc3230d673545953d35767fbf85f61d86b44170d61200d1ffb4f4945268bfc3a7b1403
SSDEEP

12288:Tc1dZibTD9uOroAgeHvCUt4RtlTc+YNKpQsNvVd1gF:Tcc/DwOrZgeHv54Rt6+YNkQsNmF

Score

10^/10

flawedammyy discovery trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	AA_v3.5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	AA_v3.5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	AA_v3.5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	AA_v3.5.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.5.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	AA_v3.5.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c17525390571c77a802b36b	AA_v3.5.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 709e5e93495c48a09bc04aabee40c47bc0f0aa627ff8a3f3f4b922c63b1b1fe9979a251e4c5841e9650996bb68d00d47e7388b9f21c1bdd4a747f052b5500488f82eb04fc33412fc33ecdb	AA_v3.5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AA_v3.5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	AA_v3.5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	AA_v3.5.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1968	AA_v3.5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1968	4924	AA_v3.5.exe	84
PID 4924 wrote to memory of 1968	4924	AA_v3.5.exe	84
PID 4924 wrote to memory of 1968	4924	AA_v3.5.exe	84

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4996

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
  "C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
c3132dea7eaf04077be43d869ebb3559

SHA1
74642c0419a0b7def9780a26b366c696dc3feb7f

SHA256
cfa3fc2e444312456e18727b6c7886772480a1c60b3879a14a8ff8991914eb61

SHA512
1a79fbfc16ae76cfb81981ce9829d18f1ae62a2230f2d71140dba620c0c577fcad78ab66d2eaf9dfc95db72d9b09cbca44d6d778af189df31d3f12b274ae2c30

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
2e607707ed154e2e6a7837021328c44e

SHA1
af8f984cf19e4a2138c45a06e621f7609fb0063a

SHA256
881ac403343219aaa48a82c2902a5f4e57d71bbd5bb1936c140cba252b4adc4b

SHA512
d1a04a09c2d6fd78383fe25135c6cbc10c3dc7d91645c10758e4a06d62608e28610b5aad3244e0e0501ec768371811b8bdd237f60a9b6563a34a0fb2295ed3d3

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
714f2508d4227f74b6adacfef73815d8

SHA1
a35c8a796e4453c0c09d011284b806d25bdad04c

SHA256
a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

SHA512
1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

Download Submit