metamorpherrat | 8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe
Size 78KB
Sample240407-26yrashd4t
SHA256 8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8
MD5 4d58a1a717b57f8fd1a0e0b08e72d521
SHA1 3b12b2896e20274e18d71888f0eda019e96872bd
SHA512 d46d9fa56d0b1c044d7b12ba79bdb75e035b8fffca97872ca1a7a74041e7cc091e49a571fe8c1f57b547b5f264f573b4fd905411b21598e3815bc907f6d9f261
SSDEEP 1536:PPy5jS/dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96V9/n17mQ:PPy5jSen7N041Qqhga9/J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe

Executes dropped EXE 1 IoCs

pid	Process
3316	tmp3662.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp3662.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3572	8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe
Token: SeDebugPrivilege	3316	tmp3662.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1212	3572	8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe	88
PID 3572 wrote to memory of 1212	3572	8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe	88
PID 3572 wrote to memory of 1212	3572	8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe	88
PID 1212 wrote to memory of 100	1212	vbc.exe	91
PID 1212 wrote to memory of 100	1212	vbc.exe	91
PID 1212 wrote to memory of 100	1212	vbc.exe	91
PID 3572 wrote to memory of 3316	3572	8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe	92
PID 3572 wrote to memory of 3316	3572	8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe	92
PID 3572 wrote to memory of 3316	3572	8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe	92

C:\Users\Admin\AppData\Local\Temp\8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe
"C:\Users\Admin\AppData\Local\Temp\8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zr1cdr0h.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES372D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD82972DFEBE24FF6B44C1782B2A0A25C.TMP"
    3⤵
    PID:100
- C:\Users\Admin\AppData\Local\Temp\tmp3662.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3662.tmp.exe" C:\Users\Admin\AppData\Local\Temp\8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES372D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES372D.tmp
Size 1KB
SHA256 b1a59a4e3691f8dba505d9bdab5f03165f9940b9d4b62fe2d13496298c4eac1c
MD5 1594e14faa6b9a419ef51ef3bdc33440
SHA1 4be649a8e1c8aa9a3f93f35c7b066f1e48c7e1ba
SHA512 c7f91e8323ed9fb3f69cd3cc048fdcb223c425afd261b7ea43985172dc8bc3850b847420323ba86229cc0a75a933ac7d554d215dcaa07929873f416571d923a3
MD5 SHA1 SHA512

Submit Download

tmp3662.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3662.tmp.exe
Size 78KB
SHA256 5eda6d03065a63a873f0611f94c72ca9ee416d64cb3547355ca1a7536eb64eb6
MD5 7f06c2d19f253fa1728a33115459f989
SHA1 3533a3e4c2e5594c52c57a7ab2e3e0227e546e40
SHA512 e102893ff1f275f9b964266015fa42596e9117b0b7488c1480840210d9795d8bee576da626a90828aa158687cc20163a9adba05d5916583abc234325b58bcff8
SSDEEP 1536:JCHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQteW9/R1gP:JCHY53Ln7N041QqhgeW9/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcD82972DFEBE24FF6B44C1782B2A0A25C.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD82972DFEBE24FF6B44C1782B2A0A25C.TMP
Size 660B
SHA256 28cd7862342a930af8325e878bac1a6b9c4317c41ee672695187a2f33bd40f87
MD5 b1553496892911a4a27d2ba942515085
SHA1 bea09ae3f3e67188041574d75d2e23daeeba5499
SHA512 c287f50401ff863aa4e78d9cf0d2dd6da0ba6b1bc05777c7984239f3f9f1976d162d7569453a7d465de74aa2c823d6d69e22fda6d24d9f57febefa3b84baab20
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zr1cdr0h.0.vb

Path C:\Users\Admin\AppData\Local\Temp\zr1cdr0h.0.vb
Size 14KB
SHA256 a08ee8d7eed1ff1f8b271c459ab7827aefbda960a28d3ea90554ee2fbf650115
MD5 87e95cd471ec341640b222d6b07887c1
SHA1 f394065cfa6fae1e8b8374fbd31f763326f5abf3
SHA512 9d5954561ff89edc3a5cb9777e182f3f98468668b6565f85d78f9244d52cf603213f9e78fb76df0ba5bfb0e269085951934dac236b6bb02fbdd5800ec3f7c7c2
SSDEEP 384:rLNuN93N8S/NneVlnP5N7RNJcHb+E6NLzN7QZSN7eP:NC99Dylr7rJcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

zr1cdr0h.cmdline

Path C:\Users\Admin\AppData\Local\Temp\zr1cdr0h.cmdline
Size 266B
SHA256 1081bb6246e1f4252eb82dc989311024e6d8d4a11af61ed82d91d71e4d0e8137
MD5 fa517438f1e7b1bf4eecb51efa7aeaed
SHA1 f0d985a1580a0f2c1e949c0467f8bea5cb5d5067
SHA512 0a28d19fc377ca44164684f1b9398e3a78083b64ffd175864624b78ebec286f982fda181565a0199fae9ae351dbf62b591ae2422ebfdf47f93b147e544858012
MD5 SHA1 SHA512

Submit Download

memory/1212-8-0x0000000002610000-0x0000000002620000-memory.dmp

Download

memory/3316-23-0x0000000001790000-0x00000000017A0000-memory.dmp

Download

memory/3316-22-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Download

memory/3316-24-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Download

memory/3316-26-0x0000000001790000-0x00000000017A0000-memory.dmp

Download

memory/3316-28-0x0000000001790000-0x00000000017A0000-memory.dmp

Download

memory/3316-27-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Download

memory/3316-29-0x0000000001790000-0x00000000017A0000-memory.dmp

Download

memory/3572-0-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Download

memory/3572-2-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

Download

memory/3572-1-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Download

memory/3572-21-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads