ammyyadmin | 47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1

General

Target

47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Size

720KB
MD5

9643383165c87cb7bc975d850efcb93c
SHA1

dce852125b8853660733b3453e70a79dd3aaf371
SHA256

47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1
SHA512

881603ea36e781c373399b6dc8b994af72744e7dcaaee40e5ded70829468b7c925e77ca7f2cb157ea56a981be4d91055af600f242f8fcf5cfc9f3123c163b5ea
SSDEEP

12288:tYdNctvsfu2LVBfKf057C9lRt3i5olGJsxhzago:edNikfu2hBfK8ilRty5olGJsxNo

Score

10^/10

ammyyadmin flawedammyy discovery rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 4 IoCs

resource	yara_rule
behavioral2/memory/4592-0-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin
behavioral2/memory/4552-5-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin
behavioral2/memory/4592-6-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin
behavioral2/memory/468-11-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin

Ammyyadmin family
ammyyadmin
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253e011edd9b834b36b	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 192ab729b2e8cad0b0cd9fbcfe8861f913ff8e6f1ef4bf532468b4976104d0f1e8ab95c4d4131239d293a9fadf371884909b9242cc3a2c0aae3ecd3bb409b35eab387dd75b34f1f9c825dd	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
468	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
468	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 468	4552	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	84
PID 4552 wrote to memory of 468	4552	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	84
PID 4552 wrote to memory of 468	4552	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	84

C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
"C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4592

C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
"C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
  "C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
4bc96d4ec814083dee15da0c255a9a10

SHA1
acb2d41b6c8bfe04095afc9b6652d58a6035b575

SHA256
606c335c1625bf26acbf2b5f86cf78f1fa5e1b3005e617f073f418a294a7648e

SHA512
4d00ca9674d62573406c7b163d3b7a42446e426ceea1c46fe5bae843cd39c2ed585fa09ca03f5ed0caa2057ed93b57c4dc3423d9fd8729512e13bf7f8fb5d20b

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
16b66c486e57fc9ae49315ab26be0f47

SHA1
e4388040d8e81a19de010cdcbb32083cedf01f07

SHA256
015fbe49b518cc3b40c26f2d690cb0dffefec2c56231b8bbae16b50fe4f9676a

SHA512
f95ba933fc8c4b5786b6e5f40af8d5ee4fb22cda14ddd1f1034a024582126a0b76ab7528df777d8c2f556b1bb262d2ddde356bcf86fd590f97cb69da99898ec9

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
4cb889e527b0d0781a17f6c2dd968129

SHA1
6a6a55cd5604370660f1c1ad1025195169be8978

SHA256
2658cd46dd49335e739cafa31ff2ec63f3315b65ecc171a0f7612713d3ac702b

SHA512
297d2c05d2ac950faeb519d3e7bc56ea9d9fcab65b5dfdbba2720be8eddc8b2d5ead3dc7c122b82d6937be6c2d7bb88872dd7b80961138571245fba381daac3f

Download Submit
memory/468-11-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/4552-5-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/4592-0-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/4592-6-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download

Analysis

Sharing