metamorpherrat | f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe
Size 78KB
Sample240404-dkybmsde36
SHA256 f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b
MD5 533e73f658e25e20e180b9045ce845b2
SHA1 2c48314e5ff97d22abf37644f7dd25b228cbfaff
SHA512 a46d7b824607c310343f1890de1fc070cd44b8abc672275b7f6a9e0b81ddcd213c34742c4007e9ffcd654789339960e9cdd6fb9cf96c529ab508d1de748733cd
SSDEEP 1536:ye5jSdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96g9/M1C0:ye5jNn7N041Qqhgj9/K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe

Executes dropped EXE 1 IoCs

pid	Process
1536	tmp64B5.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp64B5.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe
Token: SeDebugPrivilege	1536	tmp64B5.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 820	4488	f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe	93
PID 4488 wrote to memory of 820	4488	f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe	93
PID 4488 wrote to memory of 820	4488	f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe	93
PID 820 wrote to memory of 3940	820	vbc.exe	96
PID 820 wrote to memory of 3940	820	vbc.exe	96
PID 820 wrote to memory of 3940	820	vbc.exe	96
PID 4488 wrote to memory of 1536	4488	f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe	97
PID 4488 wrote to memory of 1536	4488	f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe	97
PID 4488 wrote to memory of 1536	4488	f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe	97

C:\Users\Admin\AppData\Local\Temp\f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe
"C:\Users\Admin\AppData\Local\Temp\f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1pi6u9xy.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B3D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3C9C3511482E4580AA7E21B2D138D14C.TMP"
    3⤵
    PID:3940
- C:\Users\Admin\AppData\Local\Temp\tmp64B5.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp64B5.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4460 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1pi6u9xy.0.vb

Path C:\Users\Admin\AppData\Local\Temp\1pi6u9xy.0.vb
Size 14KB
SHA256 7e1d46cf9f60de8cf4e625db1263226df10ec4ddac651a234dcedcb350d54c73
MD5 c413c9ded4a169b1a80d2c8a23f1c584
SHA1 6729fd07b41bc18dd87eddf73ae21387b3ae7bea
SHA512 96744c8c47a7b5f6729bd191a988d5edab2e9eafa79569a50d3a620b8bcc998295b5cdfae70a60183b8bb2c51a572cf306513d5868d9afa067092ff1c14109f7
SSDEEP 384:rxNANm02NpNsVlnyNwNQcHb+E6NLzN7QZSN7eP:nomrjQle4QcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

1pi6u9xy.cmdline

Path C:\Users\Admin\AppData\Local\Temp\1pi6u9xy.cmdline
Size 266B
SHA256 3094872d1353a5120162227ad385918cc8d1e887fe3426b6c61e1b3adfa23cf8
MD5 101b68a35854fb97e3091f2165409f56
SHA1 bb8d4c46e96cd0563b8efd7ddc8362e46af4bbe7
SHA512 b52f4d25f544d440cac6a8125f94cca6e3431dcb870a62d72c780035f8807005da8d52dfe55b7f4da911137e5969d9bc82d949bec5ae5494a86551c40bfc9bf7
MD5 SHA1 SHA512

Submit Download

RES6B3D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6B3D.tmp
Size 1KB
SHA256 06c2eef2b0a510c6002065c4c6436eedf4f46f1b04bd750427e305f2f14c8098
MD5 e72d037232ed383d75a173316307c871
SHA1 f7d812afefe49c62e6e568b57f380d963cef5218
SHA512 76d1a0ed0b446239c2894ab2909209e45643238eb87f116e3bf575148f8defbbdb843795fb21fa5f17d04520d387498a81ecd2a4da2333cc3bfc15ec7e26b737
MD5 SHA1 SHA512

Submit Download

tmp64B5.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp64B5.tmp.exe
Size 78KB
SHA256 6ef5ea004dd61d5159465b82821afd5615ed637e3a3785ab4414ff61cddea6ef
MD5 33558278076ca8c33bf34c72e7962016
SHA1 78f2f2291b0f1b8995c15335c0085c65487e29f8
SHA512 56acf20f487f62a39e1dd38a47d6ba536f230cbda5dca611ea9e2432dba64ee14055a0756dc5f0b21a1fae2ccf8c0e4f27b9709aedd28d01ed2d3004c79d1be7
SSDEEP 1536:kuHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQte29/n1hr:kuHFq3Ln7N041Qqhge29/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc3C9C3511482E4580AA7E21B2D138D14C.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3C9C3511482E4580AA7E21B2D138D14C.TMP
Size 660B
SHA256 a32a5c6c391fade601db38767f5574db1b3ce0f24392088bd30e2e23f22f7a99
MD5 da47bca8acde2ce3ac911c6cfd2d9e24
SHA1 b58380e28bf30e9c3c2e04d7c701c77a9611f2a1
SHA512 59e24fc582ea6e3c4aa0521ebff70edc1f92815b12ab0323e0925b5000ab304d87260d63d6399de1df08c5b02049df9d9724e69f2de5fc3aa4e5095d8a119513
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/820-8-0x00000000024D0000-0x00000000024E0000-memory.dmp

Download

memory/1536-21-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/1536-23-0x0000000000D50000-0x0000000000D60000-memory.dmp

Download

memory/1536-24-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/1536-26-0x0000000000D50000-0x0000000000D60000-memory.dmp

Download

memory/1536-27-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/1536-28-0x0000000000D50000-0x0000000000D60000-memory.dmp

Download

memory/1536-29-0x0000000000D50000-0x0000000000D60000-memory.dmp

Download

memory/4488-0-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/4488-2-0x0000000000F80000-0x0000000000F90000-memory.dmp

Download

memory/4488-1-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/4488-22-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads