metamorpherrat | 621d30c45f2c271f2b5dc84fd0b4e1998e7a78cdce4dcf0abac93795c83a26a9

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe
Size 78KB
Sample240406-qb91asba2y
SHA256 621d30c45f2c271f2b5dc84fd0b4e1998e7a78cdce4dcf0abac93795c83a26a9
MD5 e29c065b3cc8cf0d428ba543285c903c
SHA1 a1ea91c8eedaa2f4f1851574eabfd686e8830fa7
SHA512 31a0b365ddc3d0e070addce178747f990504c6e2661f515bcd9b54fd4f88c956585c2bd4df4788e5e16b4bb5d51246911f81dccac38817f7d51b383fa4a6c60c
SSDEEP 1536:aCHFo6JIdXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtH9/sP1+C:aCHFoOINSyRxvHF5vCbxwpI6WH9/s/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1128	tmp63CB.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_perf2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mscordbi.exe\""	tmp63CB.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe
Token: SeDebugPrivilege	1128	tmp63CB.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 1064	4808	e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe	88
PID 4808 wrote to memory of 1064	4808	e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe	88
PID 4808 wrote to memory of 1064	4808	e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe	88
PID 1064 wrote to memory of 4584	1064	vbc.exe	90
PID 1064 wrote to memory of 4584	1064	vbc.exe	90
PID 1064 wrote to memory of 4584	1064	vbc.exe	90
PID 4808 wrote to memory of 1128	4808	e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe	92
PID 4808 wrote to memory of 1128	4808	e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe	92
PID 4808 wrote to memory of 1128	4808	e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iazbxnsm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES659F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7ABA8C7E73044F4EB6FE2F7F1A44828D.TMP"
    3⤵
    PID:4584
- C:\Users\Admin\AppData\Local\Temp\tmp63CB.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp63CB.tmp.exe" C:\Users\Admin\AppData\Local\Temp\e29c065b3cc8cf0d428ba543285c903c_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES659F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES659F.tmp
Size 1KB
SHA256 ac3bb0c3b7bbdb94384ba9198e0bd43b13ebfe6204017d99467fa40d41124e31
MD5 2f4116b6d8d0a3a2e6ee2d71f72f0978
SHA1 57d9b6e943586ebb836b87b819149f6d0eb0f195
SHA512 dd4ba68b73228a850307100a571d88d7c356f91203099c5e415ceb8db04ee2135bc79822ca2a68ba3d0af2d2854819e64b4116813a90ed742058fb64e568e306
MD5 SHA1 SHA512

Submit Download

iazbxnsm.0.vb

Path C:\Users\Admin\AppData\Local\Temp\iazbxnsm.0.vb
Size 15KB
SHA256 0e197c1d41ba86ef37eea85527a58fea961cfed8ef895d806891820f20e5bfc1
MD5 72f9f06bd27d3031a32d253ad792b463
SHA1 45dda38ef95c4715e192ef6750b6474566bdf248
SHA512 737fa7de8696f23fc853f8121eedab7532fe3c3ee30b0a03842a8d19c6092e006776692bf803362fb922183e31f8869021289583f776649f65b3552cc45fc1be
SSDEEP 384:rqwNyaNXONGJNre5z67gNDNccHb/E6NXGzN7QKSN7eP:tyGyGD65z6sRccHfXGhL+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

iazbxnsm.cmdline

Path C:\Users\Admin\AppData\Local\Temp\iazbxnsm.cmdline
Size 266B
SHA256 6d80bffbfc18f9970006877997deaaf80d7ea83577a48d223a859bf2de7bad1e
MD5 5b2b4520df36187d36f398ea16a5cacf
SHA1 9ad8809ca4e5dac3d7fa530cc8bb8360e3a8c0c8
SHA512 88731cc82a35f78f75f96e393381c25707d9bf0f007d06a17e5d2a32d8d607af18f2a6bd67271638fc564a184fa58600c622fb117daf7f87dc3c7e364499a215
MD5 SHA1 SHA512

Submit Download

tmp63CB.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp63CB.tmp.exe
Size 78KB
SHA256 b0490d9776e73633796fa29a2b34127c80d8079f0e03dd52a51bb7568cea9469
MD5 c89f09f032d487b223c713c80dee076c
SHA1 e5997f072a48729e705fb26b7d54db9f9943d155
SHA512 22072dde3ab4dd7b51ceb8b060504d38e610ec0ff2faf6f4bd2131fc8a8b370514718ecaf690235f8027418506fb9c3ae998f443bbcb8e12b5f65aa96c4c4ba4
SSDEEP 1536:gPWV5jS8XT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQti6Cp9/j1gV:gPWV5jSkSyRxvHF5vCbxwpI6WKp9/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc7ABA8C7E73044F4EB6FE2F7F1A44828D.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc7ABA8C7E73044F4EB6FE2F7F1A44828D.TMP
Size 660B
SHA256 e14671053edfbc68e68fdd4b77473998f66abf5c6db3765e9b0fa562387af255
MD5 1fd5d8d1bfa7209376343106dcddb647
SHA1 509deda16d585bc89655a78f839088c157b70a7c
SHA512 317f097265ef288e3fd236926908e73273453e179990cd8c22e9263dc3d5ca28ea7f805449442f14a28655491c5d7bd63b2d6a589e0eaffae6fab49452cacc14
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e2eb52524ddfed5e52a54484b3fecdc9ebe24fb141d1445d37c99c0ab615df4f
MD5 097dd7d3902f824a3960ad33401b539f
SHA1 4e5c80de6a0886a8b02592a0c980b2bc2d9a4a8f
SHA512 bb77c3f7b9b8c461b149f540a0dab99fdde474484b046d663228d8c0f1b6a20b72892643935069dd74134c8ab8e8f26b6badc210a6929a737541b9861007fbe4
SSDEEP 1536:0XT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtQ:sSyRxvHF5vCbxwpI6WQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1128-21-0x0000000074F50000-0x0000000075501000-memory.dmp

Download

memory/1128-22-0x0000000000B20000-0x0000000000B30000-memory.dmp

Download

memory/1128-23-0x0000000074F50000-0x0000000075501000-memory.dmp

Download

memory/1128-25-0x0000000000B20000-0x0000000000B30000-memory.dmp

Download

memory/1128-27-0x0000000000B20000-0x0000000000B30000-memory.dmp

Download

memory/1128-26-0x0000000074F50000-0x0000000075501000-memory.dmp

Download

memory/1128-28-0x0000000000B20000-0x0000000000B30000-memory.dmp

Download

memory/4808-2-0x0000000000D80000-0x0000000000D90000-memory.dmp

Download

memory/4808-0-0x0000000074F50000-0x0000000075501000-memory.dmp

Download

memory/4808-20-0x0000000074F50000-0x0000000075501000-memory.dmp

Download

memory/4808-1-0x0000000074F50000-0x0000000075501000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads