ammyyadmin | 1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773

General

Target

1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Size

752KB
MD5

6f9063367d2017134dc377e7e7aea1b0
SHA1

cf939b505705dad12d7ab796213f26e4ef3f2bee
SHA256

1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773
SHA512

68d6eaeeea60ec39857e3d0b5f8ef0996cc8c62a378cebe79c811c2c6959069d09aeec31bdbc8b92ce5064cee1c21b3965826f0fbd780e52d00a2b5d4156764e
SSDEEP

12288:Pc1dZibTD9uOroAgeHvCUt4RtlTc+YNKpQsNvVd1g:Pcc/DwOrZgeHv54Rt6+YNkQsNm

Score

10^/10

ammyyadmin flawedammyy discovery rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 4 IoCs

resource	yara_rule
behavioral2/memory/1216-0-0x0000000000400000-0x00000000004C5000-memory.dmp	family_ammyyadmin
behavioral2/memory/3180-5-0x0000000000400000-0x00000000004C5000-memory.dmp	family_ammyyadmin
behavioral2/memory/1216-6-0x0000000000400000-0x00000000004C5000-memory.dmp	family_ammyyadmin
behavioral2/memory/1732-11-0x0000000000400000-0x00000000004C5000-memory.dmp	family_ammyyadmin

Ammyyadmin family
ammyyadmin
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c17525380d54b72883bb36b	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 32d825ec1577f486e1f962cacdbb5160c244da7790b717d7818ae61bde8255b720057993eba004df2540827c9da2c5e4610996eff585f0417039171625dd3f206ea317e4b6dac736521058	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1732	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 1732	3180	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe	84
PID 3180 wrote to memory of 1732	3180	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe	84
PID 3180 wrote to memory of 1732	3180	1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe	84

C:\Users\Admin\AppData\Local\Temp\1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
"C:\Users\Admin\AppData\Local\Temp\1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1216

C:\Users\Admin\AppData\Local\Temp\1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
"C:\Users\Admin\AppData\Local\Temp\1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Users\Admin\AppData\Local\Temp\1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe
  "C:\Users\Admin\AppData\Local\Temp\1266bca10b842bccc74f069cb5f3db41bcca11e331d7bf675122ada839bcb773N.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
3492cb1ca561392b55897921edfc2fa3

SHA1
d4155196e4255df18b924e10cd26777776d54082

SHA256
02218176aa660a0ece2d68d1dc285618b717e6a3644030954258bd49bc408ca3

SHA512
11c2bcabad4edb91f7d3f632c45fa608b24a2c731eed7d96d1d97513f22a111d9ecb0599490671abedc82748204cec0513f3c8915b8b0e7ee4b432c473282a9f

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
e602f197496a4ec4553493c73edad276

SHA1
c30bf166aaec59f99a0bdd1461e039aacdeb5aa7

SHA256
61f4ecab3cee9d2e6f04cc418609ffa6b62ff1907a510302b29c9cd6503f79e9

SHA512
db2361779d6687dd8e8110cf8ed4c38574c5b4137ccf897ae8dc7d9691a34d1a6b254854e002a14c6214c1d0d94520340c150524d94f8ff75c47e4e648eb2e23

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
714f2508d4227f74b6adacfef73815d8

SHA1
a35c8a796e4453c0c09d011284b806d25bdad04c

SHA256
a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

SHA512
1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

Download Submit
memory/1216-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1216-6-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1732-11-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/3180-5-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download

Analysis

Sharing