metamorpherrat | 1a9ee379fa99ac78be460d500492e050d21965cd8f0575c4fb2fd2830278633c

Analysis

max time kernel
165s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deddb4c05d21ebfe287148692017b375.exe
Size 78KB
Sample240326-lsyldafe34
SHA256 1a9ee379fa99ac78be460d500492e050d21965cd8f0575c4fb2fd2830278633c
MD5 deddb4c05d21ebfe287148692017b375
SHA1 fc5e251b39d49f7d93b024dac1cac07113b17ec9
SHA512 28645e2dd19be55f86153d31c0942f29b55ff6d8e6c972fab1f67caf9832bb095689f0c79fb6e6efb0192b7206f9dccc9e85bb10e38891ea5ec227b3a7a5b65c
SSDEEP 1536:15jSfXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96T9/+s12D:15jS/SyRxvhTzXPvCbW2Uo9/a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	deddb4c05d21ebfe287148692017b375.exe

Executes dropped EXE 1 IoCs

pid	Process
3732	tmpAC2E.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmpAC2E.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	deddb4c05d21ebfe287148692017b375.exe
Token: SeDebugPrivilege	3732	tmpAC2E.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 948	1220	deddb4c05d21ebfe287148692017b375.exe	89
PID 1220 wrote to memory of 948	1220	deddb4c05d21ebfe287148692017b375.exe	89
PID 1220 wrote to memory of 948	1220	deddb4c05d21ebfe287148692017b375.exe	89
PID 948 wrote to memory of 1460	948	vbc.exe	92
PID 948 wrote to memory of 1460	948	vbc.exe	92
PID 948 wrote to memory of 1460	948	vbc.exe	92
PID 1220 wrote to memory of 3732	1220	deddb4c05d21ebfe287148692017b375.exe	93
PID 1220 wrote to memory of 3732	1220	deddb4c05d21ebfe287148692017b375.exe	93
PID 1220 wrote to memory of 3732	1220	deddb4c05d21ebfe287148692017b375.exe	93

C:\Users\Admin\AppData\Local\Temp\deddb4c05d21ebfe287148692017b375.exe
"C:\Users\Admin\AppData\Local\Temp\deddb4c05d21ebfe287148692017b375.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ikktdoof.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF7A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc933B48527C45449D994BEFA0107B9D86.TMP"
    3⤵
    PID:1460
- C:\Users\Admin\AppData\Local\Temp\tmpAC2E.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpAC2E.tmp.exe" C:\Users\Admin\AppData\Local\Temp\deddb4c05d21ebfe287148692017b375.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESAF7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAF7A.tmp
Size 1KB
SHA256 8b69545a442b89ead1ffd00d404b15fc053c3c77bc9182e646759cddf086e3d0
MD5 91c201c832d53164ad4575def6a11764
SHA1 24d81a4d2e71699bc46c09e654d2420917257ce6
SHA512 eaa0e03480f0e82ae99a35cb3d7d9cdbd68616bc1b095a16f687225b50bc78e5b1a21cf134cb39ab6490699a22853e49f617dd4ff011c83a62370912d0bbaf2b
MD5 SHA1 SHA512

Submit Download

ikktdoof.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ikktdoof.0.vb
Size 14KB
SHA256 f7546a2de98031162b9e6a75712d0ec6d9003e5e777ccce5e3e9e13197d728b9
MD5 9da38b5c8d7d60efb1ca08d475180ab4
SHA1 02285b43a0f0d9d79fa40d3c3d4893f63b5f63c7
SHA512 6ba3ee92ca0f47f65b73d73cdc73df1e68703ac11e173232589217a587ed4175595c8946b42542594eb7681e73164154c766c0484d4c49b49dc6b8c633c34794
SSDEEP 384:rBgSNqNalNe0NfgckFzkN+N4cHb4E6NUzN7QPSN7eP:dg+2ae0ouy4cHQUhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

ikktdoof.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ikktdoof.cmdline
Size 266B
SHA256 929d2c2cf34382eb48a49ee85b35d4634525b59d9ee1ea40a96f8c9db5b1dbb4
MD5 ca1d930360045cbe7378ceb527a109c2
SHA1 0dafdae3be202232001bfd69cbf76d740d1f485a
SHA512 77d0773cbd4eaa6057a2d81ecca4d625812244c86bcc9725194aacb28b9b39313b87b9940bfa5951559e4b0ad2e140608eb62d103d7d210184ae100c6d58ec45
MD5 SHA1 SHA512

Submit Download

tmpAC2E.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpAC2E.tmp.exe
Size 78KB
SHA256 954ad1930ad08426d1e84ec95b14a69c06b55eb05f55503abe4a6116fb5a9145
MD5 a639a61b13e73d3f95dcd6e524b31f91
SHA1 fe93a626d7c27e30c1149511b99192497ff7bf93
SHA512 c37575c88ba834236d70e18e19900a443def7ad9f28588507f547ec82dfd89e95e3d5fded9ff85d7dbeeec3b3bc97020f570348f9b99b1177d75b441938db03c
SSDEEP 1536:9PWtHY6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtD9/y1RR:9PWtHYnhASyRxvhTzXPvCbW2UD9/0
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc933B48527C45449D994BEFA0107B9D86.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc933B48527C45449D994BEFA0107B9D86.TMP
Size 660B
SHA256 813a8d4a17820cc9b31a405770147d2ae00ee1b530b9e27fb8e3a4bc7abcfb4b
MD5 96248a51511ef3a80b2d77bbdcb5de51
SHA1 48b33f00120cfcab659d7ad6fd06626539246315
SHA512 500113462580e710ba1048656206433116b9a357183ed026a66b62829286286eb7cbdd6ad7c287a1fb82e826bfab3e3edd4ad2c9af20fca511449d0f4122dea1
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-8-0x00000000024F0000-0x0000000002500000-memory.dmp

Download

memory/1220-0-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/1220-1-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/1220-2-0x00000000010E0000-0x00000000010F0000-memory.dmp

Download

memory/1220-23-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/3732-21-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/3732-22-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

Download

memory/3732-25-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

Download

memory/3732-26-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/3732-27-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

Download

memory/3732-28-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads