metamorpherrat | 88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/03/2024, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe
Size 78KB
Sample240331-3m3ftafg58
SHA256 88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9
MD5 af437ae7eaeb9d561256c31d9fabfdfd
SHA1 9df43798de12b7e26740772411fea7ce970a57fd
SHA512 1eaf83c89bb2c54133f480486859b306d35649f639c2b955e274e169f5f8e8fab117ac1d74f0b4870b0805810ce286541319967cb11e78e56385638cb79803c3
SSDEEP 1536:lRWV5jWdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96W9/Vd1UC:lRWV5jhn7N041Qqhg19/h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2548	tmp6EBA.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe
2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp6EBA.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe
Token: SeDebugPrivilege	2548	tmp6EBA.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 3028	2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe	28
PID 2472 wrote to memory of 3028	2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe	28
PID 2472 wrote to memory of 3028	2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe	28
PID 2472 wrote to memory of 3028	2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe	28
PID 3028 wrote to memory of 2580	3028	vbc.exe	30
PID 3028 wrote to memory of 2580	3028	vbc.exe	30
PID 3028 wrote to memory of 2580	3028	vbc.exe	30
PID 3028 wrote to memory of 2580	3028	vbc.exe	30
PID 2472 wrote to memory of 2548	2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe	31
PID 2472 wrote to memory of 2548	2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe	31
PID 2472 wrote to memory of 2548	2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe	31
PID 2472 wrote to memory of 2548	2472	88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe	31

C:\Users\Admin\AppData\Local\Temp\88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe
"C:\Users\Admin\AppData\Local\Temp\88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kscbl8gu.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7206.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc71F5.tmp"
    3⤵
    PID:2580
- C:\Users\Admin\AppData\Local\Temp\tmp6EBA.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6EBA.tmp.exe" C:\Users\Admin\AppData\Local\Temp\88ae50e263d0691efa32165f71b4954658c35bab82311552bfb6033e9e4319e9.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7206.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7206.tmp
Size 1KB
SHA256 4b1bcee77d84656cc860cd209e4b6c49e0a24a6aaed54fc6f43ca590b7276910
MD5 23817dd4bb96b792a632d809e4d02e54
SHA1 c99fdf38b13f6b1ac2c5451e5ce675bfaa01b87e
SHA512 4808e1b3ef8ec5ac2fdf1c8da5f50981d83071b6d46b73cd96f8d4d86d9862346238a1afb128d79c01a24df439bb48c1cf22ae222579298b24b2fa6699887036
MD5 SHA1 SHA512

Submit Download

kscbl8gu.0.vb

Path C:\Users\Admin\AppData\Local\Temp\kscbl8gu.0.vb
Size 14KB
SHA256 a11aed76816663e13cac1c272ad3d75b6c30fae0b3e31efdef9991bfb784b75e
MD5 2a59a8f2621c0ea2b7b6866d02f145f1
SHA1 41908e8f96792eecbf062dfb8aaa7ebdb06d351c
SHA512 ef5596223ee9af78b472970bd08f5cf351331d14697ac6862dbb8aa382ac60e189a3912ebf486fbfb6630c7f6987bd55b7af55c6581638caac5a3264daee89d1
SSDEEP 384:rBQNe8NSnNLLNVVlnfRoNG6Nf6cHb+E6NLzN7QZSN7eP:2lSNL5TlJQGmf6cHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

kscbl8gu.cmdline

Path C:\Users\Admin\AppData\Local\Temp\kscbl8gu.cmdline
Size 266B
SHA256 8bf5fa81d42c90c14a4ee4bf2fa9d30bcb0f713fe1737c2e635de173d7cd725f
MD5 19e525a9c6d29dd71874e511a2e0a889
SHA1 e3b7182b5c90d6eed33cfb68f3fb3bad57efdf64
SHA512 6ebe6dedeb678d0c38779751c75f219d1ac4675d654aeb8c04f3b227ca1c9e0f702a3ce8af83c2ed65d7d4b4bd127813197ee95f534c286a67f960fb4cfc735c
MD5 SHA1 SHA512

Submit Download

tmp6EBA.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp6EBA.tmp.exe
Size 78KB
SHA256 9228d94a7c9a10ceac295418998d6deeffa09c8cf2ba017b4d4baf5178739c9c
MD5 438a488516bdaf30653875386446314e
SHA1 e213e64eec729f33fbf7942d1134fc42a3de1537
SHA512 4a3bae0396f3a2e004191a123814c5207cf9b0744d6f5a6d23e1fcdeebcb5796bff2258a3581728452116619036def3811264d54056db1a29402bc50b6088fc6
SSDEEP 1536:QHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt1g9/j1n8:QHa3Ln7N041Qqhg1g9/e
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc71F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\vbc71F5.tmp
Size 660B
SHA256 9d8e95e5ca7571b0ee82601a971ce6d4fba3542a15b9f9017616dc3df92829af
MD5 01a32419612d3ea9729f3c08f8068344
SHA1 abdd60fcfab9d2e09893a91f96e94f5f21598219
SHA512 2fbe183f54131e4401cac0ee74a604dfebffe76179eb5e4cefe1336a43fabbcb3451b45a5ac1fe9814c2ce2ac7f52fa37fb9dd1af8bcb599597c6d9948f80ecb
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2472-23-0x0000000074170000-0x000000007471B000-memory.dmp

Download

memory/2472-1-0x0000000074170000-0x000000007471B000-memory.dmp

Download

memory/2472-2-0x0000000000C80000-0x0000000000CC0000-memory.dmp

Download

memory/2472-0-0x0000000074170000-0x000000007471B000-memory.dmp

Download

memory/2548-25-0x00000000023D0000-0x0000000002410000-memory.dmp

Download

memory/2548-24-0x0000000074170000-0x000000007471B000-memory.dmp

Download

memory/2548-26-0x0000000074170000-0x000000007471B000-memory.dmp

Download

memory/2548-28-0x00000000023D0000-0x0000000002410000-memory.dmp

Download

memory/2548-29-0x0000000074170000-0x000000007471B000-memory.dmp

Download

memory/2548-30-0x00000000023D0000-0x0000000002410000-memory.dmp

Download

memory/2548-31-0x00000000023D0000-0x0000000002410000-memory.dmp

Download

memory/3028-8-0x0000000001FD0000-0x0000000002010000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads