ammyyadmin | 47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1

General

Target

47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Size

720KB
MD5

9643383165c87cb7bc975d850efcb93c
SHA1

dce852125b8853660733b3453e70a79dd3aaf371
SHA256

47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1
SHA512

881603ea36e781c373399b6dc8b994af72744e7dcaaee40e5ded70829468b7c925e77ca7f2cb157ea56a981be4d91055af600f242f8fcf5cfc9f3123c163b5ea
SSDEEP

12288:tYdNctvsfu2LVBfKf057C9lRt3i5olGJsxhzago:edNikfu2hBfK8ilRty5olGJsxNo

Score

10^/10

ammyyadmin flawedammyy discovery rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 4 IoCs

resource	yara_rule
behavioral1/memory/2660-0-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin
behavioral1/memory/2660-6-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin
behavioral1/memory/2784-4-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin
behavioral1/memory/2804-11-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin

Ammyyadmin family
ammyyadmin
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\International\Geo\Nation	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c6658524c17525307875fe6b934b36b	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = c38d931ee194aeba1e2ad98140a2855f093996ec0dc28435f6581e5af92a970c26b16dc69e68629676c3502afe00b6e180b244d3176687e0adc136f5d2bb2e842117b611f86ceb1d42f2f3	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2804	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2804	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2804	2784	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	31
PID 2784 wrote to memory of 2804	2784	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	31
PID 2784 wrote to memory of 2804	2784	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	31
PID 2784 wrote to memory of 2804	2784	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	31

C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
"C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2660

C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
"C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
  "C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
7b176beeb353955c643222706b27d9dd

SHA1
301c00e873ce0847ec729ef2d186d88b0d898a7a

SHA256
816b463f1f3f4e4759bea070df10f7c732b1aa0f1dcd867b3d049237938a2273

SHA512
aa8b64d34b213b3a4717b66d08c5e21a23fc5d5afc8024ebb1c66987094aab6fc299c515b1b3caafe782a77420637ff92718f619c6ee8dcf44c9c61d21684c7c

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
b6805050c7e2634ab99f2208b6e3ae96

SHA1
0a5293f147c8b65756185178954a9850d851ed9b

SHA256
30f34196efd89b35f05fb6595ad775a1a2a4e5b949724a866a45c0a674e1e233

SHA512
58af038863e927f3df7a7be51d499bf2155f9eea97686e52b0c98d986bc7accd95d769139cc64608788b29411f765895b99e39b8cd15207cad232a0c6095c0ac

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
4cb889e527b0d0781a17f6c2dd968129

SHA1
6a6a55cd5604370660f1c1ad1025195169be8978

SHA256
2658cd46dd49335e739cafa31ff2ec63f3315b65ecc171a0f7612713d3ac702b

SHA512
297d2c05d2ac950faeb519d3e7bc56ea9d9fcab65b5dfdbba2720be8eddc8b2d5ead3dc7c122b82d6937be6c2d7bb88872dd7b80961138571245fba381daac3f

Download Submit
memory/2660-0-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/2660-6-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/2784-4-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/2804-11-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download

Analysis

Sharing