metamorpherrat | 2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe
Size 78KB
Sample240402-yk2dhsbg4y
SHA256 2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b
MD5 9476db24b4866fd59c47754105197e06
SHA1 f68a80305737520f311920320829b998490ea753
SHA512 456a500d37bbbdc54ceb03bc045e5b0c5d650480404e6bbe81c3d2fb8a3fda93f327b0632e92e3295a7f9fb14884156757f3052df804cf1485f1b324fb73fc9f
SSDEEP 1536:mPy5Ody0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN6w9/61Pq:mPy55n7N041Qqhg39/t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe

Executes dropped EXE 1 IoCs

pid	Process
1580	tmp4DC2.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp4DC2.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe
Token: SeDebugPrivilege	1580	tmp4DC2.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1536	3884	2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe	85
PID 3884 wrote to memory of 1536	3884	2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe	85
PID 3884 wrote to memory of 1536	3884	2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe	85
PID 1536 wrote to memory of 3992	1536	vbc.exe	89
PID 1536 wrote to memory of 3992	1536	vbc.exe	89
PID 1536 wrote to memory of 3992	1536	vbc.exe	89
PID 3884 wrote to memory of 1580	3884	2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe	90
PID 3884 wrote to memory of 1580	3884	2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe	90
PID 3884 wrote to memory of 1580	3884	2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe	90

C:\Users\Admin\AppData\Local\Temp\2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe
"C:\Users\Admin\AppData\Local\Temp\2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wd4eiid7.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E9D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1FA32B5F66D9448498DB13B1A6275ABE.TMP"
    3⤵
    PID:3992
- C:\Users\Admin\AppData\Local\Temp\tmp4DC2.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4DC2.tmp.exe" C:\Users\Admin\AppData\Local\Temp\2bdd29d7541586a2d348d80278e62127b05e6aa09862f9951ae68a4eb398e96b.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4E9D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4E9D.tmp
Size 1KB
SHA256 bd0cdacd27dd239b6dac66a89cd2447a377aca6be70de4e4327d9d7dc3ce59d0
MD5 9822392fbe7af492fa045a56de981897
SHA1 4faab3811aa3ae0272bb92e03e5529b2df2c2a96
SHA512 16d02e6b20b52cca161ab9e40e0828f9e17f50b5e07c133d9955e8e70def00a0eb43ce61b83f01fb2fe5610dce4053593659e5b1d55069602fef568bba15b3b2
MD5 SHA1 SHA512

Submit Download

tmp4DC2.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4DC2.tmp.exe
Size 78KB
SHA256 98fcbcbbdfc2166efbabac79dd3c89ac6d70c00e112ec8ee0d848502135ff11d
MD5 b2ebc168279dbcd2d8568d1db4533ec7
SHA1 c0f1ac4e73d0759be253b8670e8a3e2905af9fe6
SHA512 1f534c0fca6bddf03deccd9c95ed0fc8b09ee24e1c9c268078e1574b7371cafae1fb2d296a6b26c5091d232db48c446087bb3cfc98d912cd0068daf59a1a565f
SSDEEP 1536:I4tHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQty9/s1cv:I4tHY53Ln7N041Qqhgy9/z
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc1FA32B5F66D9448498DB13B1A6275ABE.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1FA32B5F66D9448498DB13B1A6275ABE.TMP
Size 660B
SHA256 90ae559f1968d190f1ebe96cb46bc657dccdb57cda589d57147b97c39237a4ce
MD5 9c6e10c32f1c52eb335346011097aa2b
SHA1 d924ad0468123ed177dae276aa01e87cda30496e
SHA512 921a6cd021de1f927cfbe6658861f0146c6e4ee8117282d7fc11bd402db2c9cffcbf349dddc4e90ff0646d9bea81b064a0f0d5078705500af2a03840e09e002f
MD5 SHA1 SHA512

Submit Download

wd4eiid7.0.vb

Path C:\Users\Admin\AppData\Local\Temp\wd4eiid7.0.vb
Size 14KB
SHA256 41aaaf47fc7b3e0bb669269e84b2ffc8b165f474152da9342d7a19ae55c43c10
MD5 cb6f0fb13bfaf657f1351951547d72b6
SHA1 76d030252c34c69e238aa0052bc59951f1594b00
SHA512 c3efa3112c64cf42310d47ebae9ca924c9dde4912f20b6f70946ac0f737673c0fbc258f6ad2e17942434dfec9fda7135a42b17336317751c0c39b168d0717ec4
SSDEEP 384:rsNPZNuuNGN5bNicVlnOINoN1cHb+E6NLzN7QZSN7eP:QLuCGN3zlOwQ1cHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

wd4eiid7.cmdline

Path C:\Users\Admin\AppData\Local\Temp\wd4eiid7.cmdline
Size 266B
SHA256 b03cb076477beabaebb123dd08a26706d11d577668b5d32fffd26ae763068d76
MD5 2cbc36430725cddca9655ed4357a23cd
SHA1 11704b4e97e69fcdecb97e8cdb55f56637fc2eef
SHA512 69f947348dc5d0651e35b1d5cd7651cb16a405ba75d84d078ae3c8d308c305038bc3f653e3c8c7fe61a8d34d3b9186554af1a826f27e74d9c7f27f542afedb3f
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1536-8-0x0000000002470000-0x0000000002480000-memory.dmp

Download

memory/1580-23-0x0000000001810000-0x0000000001820000-memory.dmp

Download

memory/1580-22-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/1580-24-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/1580-26-0x0000000001810000-0x0000000001820000-memory.dmp

Download

memory/1580-27-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/1580-28-0x0000000001810000-0x0000000001820000-memory.dmp

Download

memory/1580-29-0x0000000001810000-0x0000000001820000-memory.dmp

Download

memory/3884-0-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/3884-2-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/3884-1-0x00000000015D0000-0x00000000015E0000-memory.dmp

Download

memory/3884-21-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads