ammyyadmin | 47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1

General

Target

47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Size

720KB
MD5

9643383165c87cb7bc975d850efcb93c
SHA1

dce852125b8853660733b3453e70a79dd3aaf371
SHA256

47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1
SHA512

881603ea36e781c373399b6dc8b994af72744e7dcaaee40e5ded70829468b7c925e77ca7f2cb157ea56a981be4d91055af600f242f8fcf5cfc9f3123c163b5ea
SSDEEP

12288:tYdNctvsfu2LVBfKf057C9lRt3i5olGJsxhzago:edNikfu2hBfK8ilRty5olGJsxNo

Score

10^/10

ammyyadmin flawedammyy discovery rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 4 IoCs

resource	yara_rule
behavioral2/memory/1284-0-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin
behavioral2/memory/2772-4-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin
behavioral2/memory/1284-6-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin
behavioral2/memory/4200-11-0x0000000000400000-0x00000000004C4000-memory.dmp	family_ammyyadmin

Ammyyadmin family
ammyyadmin
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = d6402f3c62c7cc06fc6359d41adc9589d6b32194d25c5ecb156d4bd12ef091531820af45839beaa39e7b8544c33fcb89cefbe6378d9f0d780b6588cb9df25ad34360ae06668b5a008ed9ee	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253c23b71e9b934b36b	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4200	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4200	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4200	2772	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	84
PID 2772 wrote to memory of 4200	2772	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	84
PID 2772 wrote to memory of 4200	2772	47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe	84

C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
"C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1284

C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
"C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe
  "C:\Users\Admin\AppData\Local\Temp\47a1a965b80da9561f8433e31fddb685fe510c9ebab417097acd06cfbb3fc9f1.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
d5e200df3b47e3999b85038fa16613de

SHA1
1d09c41c56c9024f88c320ae06ecb51b1a28dcef

SHA256
9d92e1ebfa7c6ac2ec38732f012a26d09dacf6e765c6ba3ed2881f73ab03736b

SHA512
a5b6bb8031b35dd331b7e5fecd5e845e144b7f98e1b4ccf338e61c5adf8a0a6434dc0816cadd319fdd6a47b8b0229cf39b7ecebdf03850d00e741f0269232c38

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
d329077afb2baed70c382b035bbebea5

SHA1
ac62b3812c87c9e89d4555cc21a2542fbe2f4618

SHA256
95e36f8027898d387747d538d815f0ce1ef10d8b4e930d17f12d3f466e3960db

SHA512
4720d47c4f68f9863a2b872e0f881eefcc132faa99e7c1fcf2c863a0bdaa1673d6b7480ff90badaf6d7d967db48bd98df93e735cae942b417859e1deec6d1262

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
4cb889e527b0d0781a17f6c2dd968129

SHA1
6a6a55cd5604370660f1c1ad1025195169be8978

SHA256
2658cd46dd49335e739cafa31ff2ec63f3315b65ecc171a0f7612713d3ac702b

SHA512
297d2c05d2ac950faeb519d3e7bc56ea9d9fcab65b5dfdbba2720be8eddc8b2d5ead3dc7c122b82d6937be6c2d7bb88872dd7b80961138571245fba381daac3f

Download Submit
memory/1284-0-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1284-6-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/2772-4-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/4200-11-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download

Analysis

Sharing