metamorpherrat | 5e9876a8e6bbfbefb41e1a59357dad89812a01560602c1dc1945d4f963f18448

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e273446eab429c77d35736d1c894386a_JaffaCakes118.exe
Size 78KB
Sample240406-np6tpahc8v
SHA256 5e9876a8e6bbfbefb41e1a59357dad89812a01560602c1dc1945d4f963f18448
MD5 e273446eab429c77d35736d1c894386a
SHA1 bbb8d4dfda14cf37c8e524eedababd8d13d1fb39
SHA512 a32dedfdfa8336b2f66e6069ef26905c82aa0ebc34916bfe12763e44886dc6a6950dc454af5253ffe1a5e60a53036defdafb0f0977f61032ee03513ed7dbe776
SSDEEP 1536:jVc5SpJywt04wbje3IgTazcoOEEQLwdCRoaeuProYMHQti6Q9/M1U1:Zc5sJywQjDgTLopLwdCFJzY9/t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	e273446eab429c77d35736d1c894386a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1392	tmp6409.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	e273446eab429c77d35736d1c894386a_JaffaCakes118.exe
Token: SeDebugPrivilege	1392	tmp6409.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 5028	4216	e273446eab429c77d35736d1c894386a_JaffaCakes118.exe	94
PID 4216 wrote to memory of 5028	4216	e273446eab429c77d35736d1c894386a_JaffaCakes118.exe	94
PID 4216 wrote to memory of 5028	4216	e273446eab429c77d35736d1c894386a_JaffaCakes118.exe	94
PID 5028 wrote to memory of 3372	5028	vbc.exe	96
PID 5028 wrote to memory of 3372	5028	vbc.exe	96
PID 5028 wrote to memory of 3372	5028	vbc.exe	96
PID 4216 wrote to memory of 1392	4216	e273446eab429c77d35736d1c894386a_JaffaCakes118.exe	97
PID 4216 wrote to memory of 1392	4216	e273446eab429c77d35736d1c894386a_JaffaCakes118.exe	97
PID 4216 wrote to memory of 1392	4216	e273446eab429c77d35736d1c894386a_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\e273446eab429c77d35736d1c894386a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e273446eab429c77d35736d1c894386a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rbt281d7.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6513.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEBA154B2F399493A80B36F6D1F74808B.TMP"
    3⤵
    PID:3372
- C:\Users\Admin\AppData\Local\Temp\tmp6409.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6409.tmp.exe" C:\Users\Admin\AppData\Local\Temp\e273446eab429c77d35736d1c894386a_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES6513.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6513.tmp
Size 1KB
SHA256 fbaacd50f38770cd944b6c3c3bd79bc065c27d5690223ae54d90f3af185db90c
MD5 da8b067dd1d38700b1090de919b06b2e
SHA1 f325bb30c39c5162df6784736f57db198851c5c5
SHA512 bf5e74c12d993c6540607fcc109a9914154b0c2eafe2ae20daffd92f95421c567131c3a2f2c727b26015a11618f3d36fa076f1534f202eeb1500f71702d0a1f2
MD5 SHA1 SHA512

Submit Download

rbt281d7.0.vb

Path C:\Users\Admin\AppData\Local\Temp\rbt281d7.0.vb
Size 14KB
SHA256 9f1ff9e5276ba975839aabc1c96552a8266e9c85361e08734442d0497710d208
MD5 ce2e97a6abe6692a0343c8dbb1e40d05
SHA1 dfbd4e8509c8ce9df451054256dcb67d6fb4d296
SHA512 5cb5cf2f81777cf243c12deb1494e3d9172103f7cf2c6e3805046e0f4636a921354bc2ab9842aa0a3c1f8ddaf78b36f733bca99b80a2537e576593c97b5edc52
SSDEEP 384:r2lNLpNYNsNgAjpnNYNRcHbfSE6NOzN7QkSN7eP:SXLjgsBgRcHCOhP+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

rbt281d7.cmdline

Path C:\Users\Admin\AppData\Local\Temp\rbt281d7.cmdline
Size 266B
SHA256 941fcace07ca62ce4516381cb632e332b302b99b6dd0d2368b8455ef724fea26
MD5 6deec5654a8e09ccacbcd79cc6ecd1e5
SHA1 ae6e62f98f1626f98d4e0c58ee24001cbb53cd51
SHA512 ef4b7b2e0d14360d0c581ee6958b318364bc352f6ecbfa261d0b971bf61d7052305632fa848e7446c02dd564703b80937159de59e6e9dacfd921514dad33e121
MD5 SHA1 SHA512

Submit Download

tmp6409.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp6409.tmp.exe
Size 78KB
SHA256 9f1b5b5104338e3a2e9afe224e84b966b386183eef928f2d69c494f82aa7810f
MD5 6050524353ae65336c1d7cd536b7ba40
SHA1 1bf55658e006c4494a7c9f9099ef7b7eb875f0e5
SHA512 35b148a35f514f87ce15c480fe702aeea9388dba10bac4ccdb0bbe16b080c9f6d9bd0f01c205b68cf5a92c21509d237f45663637ddfc50930e8ff04e7d312ed3
SSDEEP 1536:oPCHHuaJtVpJywt04wbje3IgTazcoOEEQLwdCRoaeuProYMHQtD9/h159:oPCH/3DJywQjDgTLopLwdCFJzD9/3
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcEBA154B2F399493A80B36F6D1F74808B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcEBA154B2F399493A80B36F6D1F74808B.TMP
Size 660B
SHA256 e5ba6f0dcc662218ea12602a5f5f75fe3cf33af85ab4450e4f61c583a5ebf798
MD5 3845f88dff86de87cff7031bcc73441d
SHA1 b39468b74b7d506168538a45530b4f7f89fbda1e
SHA512 f81e7d849027647821c7a59363c893bf64820da765b2d02e2c2e7132ace28fbf42ebc5311130be05a6143bf9f38f0c5fdee29b4710cdc30ba0cbe1b5b54a1b4a
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 9c0a54047f133cf4e3e4444aa57cc576c566218217ea02ad7c04a408ad01791b
MD5 484967ab9def8ff17dd55476ca137721
SHA1 a84012f673fe1ac9041e7827cc3de4b20a1194e2
SHA512 1e9a0cc800543dada73e551ee714001c4d6c57a595ea2986a4dd8889d1dffd1557735580c694e5feb0b7c27c1a4b3e71a95fab8baf80839f42f80e2109cbe2d7
SSDEEP 1536:kpJywt04wbje3IgTazcoOEEQLwdCRoaeuProYMHQtQ:aJywQjDgTLopLwdCFJzQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1392-23-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

Download

memory/1392-22-0x00000000750A0000-0x0000000075651000-memory.dmp

Download

memory/1392-24-0x00000000750A0000-0x0000000075651000-memory.dmp

Download

memory/1392-25-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

Download

memory/1392-26-0x00000000750A0000-0x0000000075651000-memory.dmp

Download

memory/1392-27-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

Download

memory/1392-28-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

Download

memory/4216-2-0x0000000000F70000-0x0000000000F80000-memory.dmp

Download

memory/4216-1-0x00000000750A0000-0x0000000075651000-memory.dmp

Download

memory/4216-21-0x00000000750A0000-0x0000000075651000-memory.dmp

Download

memory/4216-0-0x00000000750A0000-0x0000000075651000-memory.dmp

Download

memory/5028-8-0x00000000024F0000-0x0000000002500000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads