flawedammyy | d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/03/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AmmyyAdmin3.6.exe
Size 762KB
Sample260329-wvm8jae12x
SHA256 d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605
MD5 e9b569f7cbf23d91df065c18f4c43840
SHA1 5d7cb1a2ca7db04edf23dd3ed41125c8c867b0ad
SHA512 a9f01663b0c0ce9d30bd6760847bf3c18318801634145ec75e047019a8e8a9b13ea8122449b8f45ad40b63d4551cb85230df1b41a41ddc33a39cfcf2ec237ccb
SSDEEP 12288:kX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VEoge:2P++ZSlpOUC1KT4+URtYshX5aRlQEYte
TLSH
T17AF4AE1239C1807FC1760531CA9A6B75EAF6FE690E768D436388BE2C1E79901DE53738
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	AmmyyAdmin3.6.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	AmmyyAdmin3.6.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	AmmyyAdmin3.6.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	AmmyyAdmin3.6.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmmyyAdmin3.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmmyyAdmin3.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AmmyyAdmin3.6.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AmmyyAdmin3.6.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AmmyyAdmin3.6.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	AmmyyAdmin3.6.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AmmyyAdmin3.6.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AmmyyAdmin3.6.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	AmmyyAdmin3.6.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	AmmyyAdmin3.6.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 2e538b0acf70f486e14c40dda422e627ed0e3679c76227cea759f67cede0522a2573ded2db28f7f926a3453f0d94f45d72c350c5d0cc6bf9b9f041bcfabc6f6b54849dad9b022398f3bda2	AmmyyAdmin3.6.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3208	AmmyyAdmin3.6.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3208	AmmyyAdmin3.6.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3208	2212	AmmyyAdmin3.6.exe	80

C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin3.6.exe
"C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin3.6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3936

C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin3.6.exe
"C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin3.6.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin3.6.exe
  "C:\Users\Admin\AppData\Local\Temp\AmmyyAdmin3.6.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings3.bin

Path C:\ProgramData\AMMYY\settings3.bin
Size 274B
SHA256 d3df407118bd28d28e7d3c8afc497c5e478e5d078f7792501ddecb45f3b51826
MD5 bcc40b676c5b0f5a176be92cc8f4199f
SHA1 5415364e6ab90151eb1272268cb75ef6c4306a2f
SHA512 467c473be5b9f6e0b8302620b6fbd9ad84f90da2bae3247d8326a22bfdd902fd79e55a2160493903eb747db6ef38fc9decb3db372afa26667f374ca2d0ceb36d
TLSH
T1BED02B2555C724F6D90BD91DF4673A94C8E1D51E12C8E4C2B1350782102AE1DB64F149
MD5 SHA1 SHA512 TLSH

Submit Download