Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 07:08
Static task
static1
Behavioral task
behavioral1
Sample
3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe
Resource
win10v20201028
General
-
Target
3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe
-
Size
78KB
-
MD5
b7522739be3b41f898204a82bebbf202
-
SHA1
350d9490d8839b357882a2777e9dbf51ebcf4006
-
SHA256
3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd
-
SHA512
e3de9441f58a7c120db5e86962abae6755bff93614d0a674e52ed23324f1f791435d69b1e0552c011388c89c5a6b5e64adbf05f9386bc560faa62daaa9b6e926
Malware Config
Signatures
-
MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
-
Executes dropped EXE 1 IoCs
Processes:
tmp861E.tmp.exepid process 2280 tmp861E.tmp.exe -
Deletes itself 1 IoCs
Processes:
tmp861E.tmp.exepid process 2280 tmp861E.tmp.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp861E.tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\"" tmp861E.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exetmp861E.tmp.exedescription pid process Token: SeDebugPrivilege 744 3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe Token: SeDebugPrivilege 2280 tmp861E.tmp.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exevbc.exedescription pid process target process PID 744 wrote to memory of 628 744 3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe vbc.exe PID 744 wrote to memory of 628 744 3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe vbc.exe PID 744 wrote to memory of 628 744 3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe vbc.exe PID 628 wrote to memory of 1320 628 vbc.exe cvtres.exe PID 628 wrote to memory of 1320 628 vbc.exe cvtres.exe PID 628 wrote to memory of 1320 628 vbc.exe cvtres.exe PID 744 wrote to memory of 2280 744 3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe tmp861E.tmp.exe PID 744 wrote to memory of 2280 744 3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe tmp861E.tmp.exe PID 744 wrote to memory of 2280 744 3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe tmp861E.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe"C:\Users\Admin\AppData\Local\Temp\3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zk8gwomo.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89B7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc616DA83934A34135AE1575B31F22542E.TMP"3⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp861E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp861E.tmp.exe" C:\Users\Admin\AppData\Local\Temp\3f5c2aacc7134dc7a7d78f4731c01db691be30d2989274f33f1b56e4090820cd.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES89B7.tmpMD5
b68f6c81742ed49f8bbfd5ff0881f758
SHA195cb681a7d1a9caa0e898f3efa55f1fb88eef7a5
SHA2561088a1f884d6927f4fff3d78780838b81ce772b98b89ec39435f33e5fc78162c
SHA5125d89d77fa4661a7d789e30b090736010c2ebd88208661eeee422391251d2532aff86a4122d788f364c7923a57735050d6d757ff9b1df8d5dd8eb464b6d09dda5
-
C:\Users\Admin\AppData\Local\Temp\tmp861E.tmp.exeMD5
028e972b292b01f092dcd748a5092b88
SHA152c9779da19287e5453f006ec123ab6877aaef16
SHA2563a7202692ab4fe7472de26cfffb165317dc74186af74992663dc717a3bc574bb
SHA512fa2ece5aec549ba9fbc18a7417053f14f40b4456660b4a5aa02c90f7b9cf87fc07c01ecda24a56482bf2613ec99baba9d71e949018a538dcb3fb218768bf7048
-
C:\Users\Admin\AppData\Local\Temp\tmp861E.tmp.exeMD5
028e972b292b01f092dcd748a5092b88
SHA152c9779da19287e5453f006ec123ab6877aaef16
SHA2563a7202692ab4fe7472de26cfffb165317dc74186af74992663dc717a3bc574bb
SHA512fa2ece5aec549ba9fbc18a7417053f14f40b4456660b4a5aa02c90f7b9cf87fc07c01ecda24a56482bf2613ec99baba9d71e949018a538dcb3fb218768bf7048
-
C:\Users\Admin\AppData\Local\Temp\vbc616DA83934A34135AE1575B31F22542E.TMPMD5
376ef97d4353e713fc4c04db35a627db
SHA116a76c33852e419678becba8f840b923ec073a3e
SHA256f8358eb909f4b8688d3504752548e672d7b0e40e9b39373ed9a339c847c6c65a
SHA5126d4deedfc942f0e52036047ec362029231a9790e5a45add5bea5a4cc6d0d0362b1c39a5c557c16106b11ec1b527d95e908acf799af0b7e746bf4db1f473bf50d
-
C:\Users\Admin\AppData\Local\Temp\zCom.resourcesMD5
4f0e8cf79edb6cd381474b21cabfdf4a
SHA17018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4
SHA256e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
SHA5122451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107
-
C:\Users\Admin\AppData\Local\Temp\zk8gwomo.0.vbMD5
cbfff9a01e74cee08ea0247debc22db5
SHA145cd38be7d36e9f7cabd9ffb385434c7716eb673
SHA2568f8fc8c03c4d60dbc66786563b6819fcb7dc4c03006708cefcddba3b3ade8711
SHA512bf8468a4c4bb2196476b3772ade2bd7078367cbd0dcd75c641182a7cf26383debc22ce22cfbcf6af4749cc201e80fa6cccd339ca20953c337605c661ee5ce8bd
-
C:\Users\Admin\AppData\Local\Temp\zk8gwomo.cmdlineMD5
56a5e4713df50af21992b5c1420c35e9
SHA1cc8270ce33326e7a44f9de6b0495f892b379ab36
SHA25651f32d2d155522e3b7b6907c4c75fc10912752629369ebd73707f1b5d7b32be0
SHA5126ab49467d0e1a9f690f344cd51bc714f958adc84cf7ddba8b790b5459000ceeabc01645344aef5c9e8c2cf6d030281d723ceb45a78b6c6d42724682cc897087e
-
memory/628-5-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB
-
memory/628-3-0x0000000000000000-mapping.dmp
-
memory/744-2-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/1320-8-0x0000000000000000-mapping.dmp
-
memory/2280-12-0x0000000000000000-mapping.dmp
-
memory/2280-14-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/2280-15-0x0000000002913000-0x0000000002915000-memory.dmpFilesize
8KB