Analysis
-
max time kernel
4294211s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
26-03-2022 17:58
Static task
static1
Behavioral task
behavioral1
Sample
ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe
Resource
win10v2004-en-20220113
General
-
Target
ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe
-
Size
78KB
-
MD5
0efed81f5339c0ad460c250ca39ff618
-
SHA1
e46747bc89bc7e78c9ab7e9c5168073b4fb8fb55
-
SHA256
ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166
-
SHA512
5f7775f59092f2dd1cb33a5e888ab3bc2f2312454780732b7888d3b85523c8167e225832f7c8b8b720d34ec690c65468bcf4ffe081270c887153381277dfcd98
Malware Config
Signatures
-
MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
-
Executes dropped EXE 1 IoCs
Processes:
tmp40E7.tmp.exepid process 564 tmp40E7.tmp.exe -
Deletes itself 1 IoCs
Processes:
tmp40E7.tmp.exepid process 564 tmp40E7.tmp.exe -
Loads dropped DLL 2 IoCs
Processes:
ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exepid process 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp40E7.tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\"" tmp40E7.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exetmp40E7.tmp.exedescription pid process Token: SeDebugPrivilege 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe Token: SeDebugPrivilege 564 tmp40E7.tmp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exevbc.exedescription pid process target process PID 1072 wrote to memory of 1908 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe vbc.exe PID 1072 wrote to memory of 1908 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe vbc.exe PID 1072 wrote to memory of 1908 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe vbc.exe PID 1072 wrote to memory of 1908 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe vbc.exe PID 1908 wrote to memory of 1956 1908 vbc.exe cvtres.exe PID 1908 wrote to memory of 1956 1908 vbc.exe cvtres.exe PID 1908 wrote to memory of 1956 1908 vbc.exe cvtres.exe PID 1908 wrote to memory of 1956 1908 vbc.exe cvtres.exe PID 1072 wrote to memory of 564 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe tmp40E7.tmp.exe PID 1072 wrote to memory of 564 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe tmp40E7.tmp.exe PID 1072 wrote to memory of 564 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe tmp40E7.tmp.exe PID 1072 wrote to memory of 564 1072 ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe tmp40E7.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe"C:\Users\Admin\AppData\Local\Temp\ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\usvmhsw2.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES427D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc426D.tmp"3⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp40E7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp40E7.tmp.exe" C:\Users\Admin\AppData\Local\Temp\ec41f7337218bc61b7f109190b36ba9d66a0118d475bc08ce51926fb79666166.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES427D.tmpFilesize
1KB
MD502e944f70b809e5fcb7866c304461d88
SHA1da0312db706e7c02e4f101c5457619bf24103ffd
SHA25674273b4eda6adc0b40e1f46ffe462ab3c926ccbf2700f02c6e1f8a8fe4dbd5b2
SHA51250c69fa5f5dbe93a6ccab953ff44090205dd7ce7c71105ad0710eb24b95fb1d6be03704eaaca3aea5f7657cd50bc61f40b0b2718a7f679fb52fa228871acd7ed
-
C:\Users\Admin\AppData\Local\Temp\tmp40E7.tmp.exeFilesize
78KB
MD5692eef7ac1a141aadbea01fa78932d86
SHA159e63fd71e8ba95d5a8341334326d5c9dfc0fecc
SHA2567fb77859a5f75373279f77fe482e945cf33dcf449e5dcdfb4306e1ce8278cf2e
SHA5126db0188fe03c3d0737531a553678ddb97d1a5e1b145a40cbd1388c7e443c0b88ac9a3c4b0182980b8ddfdbf568712bd8f59dcdf556ed30b14e3034e27b715b1b
-
C:\Users\Admin\AppData\Local\Temp\tmp40E7.tmp.exeFilesize
78KB
MD5692eef7ac1a141aadbea01fa78932d86
SHA159e63fd71e8ba95d5a8341334326d5c9dfc0fecc
SHA2567fb77859a5f75373279f77fe482e945cf33dcf449e5dcdfb4306e1ce8278cf2e
SHA5126db0188fe03c3d0737531a553678ddb97d1a5e1b145a40cbd1388c7e443c0b88ac9a3c4b0182980b8ddfdbf568712bd8f59dcdf556ed30b14e3034e27b715b1b
-
C:\Users\Admin\AppData\Local\Temp\usvmhsw2.0.vbFilesize
15KB
MD5c74a62516fc1100196d8376795c2f382
SHA1026fad7a9bd564056f5b0094033ebccfbd916cd9
SHA2560654559f8e56aa1f90aec70bf3f79c06a813a35b9279315647f5d9deb9123bf7
SHA51251d2ca881256d272265681cddb5b62af361d138be506e457bfb61ca2be877828af427c5987c104259badec8eb9c7bfd5f159c2a915414bc0bc80eedeb04f5497
-
C:\Users\Admin\AppData\Local\Temp\usvmhsw2.cmdlineFilesize
266B
MD5844f442290de7e0a9f406b07271c3c13
SHA14593cebf84a8a5f46b075c06bdc382ba7249e338
SHA25620c37a27abbe3c463732536875fd298e44ac93eb59ee7471e54172239753e0c7
SHA512f50b39c012ea0f4faaf88c8f040c2c0a4d0f7212098b759c310b6cd15984f4230977a85aaf4871e699ea8682b30c0da6f9f460e5168c0bd5d5a2a5acddb47d09
-
C:\Users\Admin\AppData\Local\Temp\vbc426D.tmpFilesize
660B
MD53ab9c493621771b1b600549cd93687a2
SHA15cce5524f59a707ea63ba9878fbc6c0403d62dcd
SHA256d5a0f6c8fab2d991826c327900938b69be405822e99abf2d04c9df0e8573f733
SHA51274c7ffc9f937f5e3e5d34717bd4efc5bb569661fe32ba0fc9e3c395492cb7452eeb8be498ad08e3086d2898b8f5f922fbd7e1dd106fad3584ed19910ce399bed
-
C:\Users\Admin\AppData\Local\Temp\zCom.resourcesFilesize
62KB
MD5aa4bdac8c4e0538ec2bb4b7574c94192
SHA1ef76d834232b67b27ebd75708922adea97aeacce
SHA256d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
SHA5120ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
-
\Users\Admin\AppData\Local\Temp\tmp40E7.tmp.exeFilesize
78KB
MD5692eef7ac1a141aadbea01fa78932d86
SHA159e63fd71e8ba95d5a8341334326d5c9dfc0fecc
SHA2567fb77859a5f75373279f77fe482e945cf33dcf449e5dcdfb4306e1ce8278cf2e
SHA5126db0188fe03c3d0737531a553678ddb97d1a5e1b145a40cbd1388c7e443c0b88ac9a3c4b0182980b8ddfdbf568712bd8f59dcdf556ed30b14e3034e27b715b1b
-
\Users\Admin\AppData\Local\Temp\tmp40E7.tmp.exeFilesize
78KB
MD5692eef7ac1a141aadbea01fa78932d86
SHA159e63fd71e8ba95d5a8341334326d5c9dfc0fecc
SHA2567fb77859a5f75373279f77fe482e945cf33dcf449e5dcdfb4306e1ce8278cf2e
SHA5126db0188fe03c3d0737531a553678ddb97d1a5e1b145a40cbd1388c7e443c0b88ac9a3c4b0182980b8ddfdbf568712bd8f59dcdf556ed30b14e3034e27b715b1b
-
memory/564-66-0x0000000000000000-mapping.dmp
-
memory/564-69-0x0000000074120000-0x00000000746CB000-memory.dmpFilesize
5.7MB
-
memory/564-70-0x0000000000295000-0x00000000002A6000-memory.dmpFilesize
68KB
-
memory/1072-62-0x00000000746D0000-0x0000000074C7B000-memory.dmpFilesize
5.7MB
-
memory/1072-54-0x00000000763D1000-0x00000000763D3000-memory.dmpFilesize
8KB
-
memory/1908-55-0x0000000000000000-mapping.dmp
-
memory/1956-59-0x0000000000000000-mapping.dmp