Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 23:12

General

  • Target

    8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe

  • Size

    78KB

  • MD5

    4d58a1a717b57f8fd1a0e0b08e72d521

  • SHA1

    3b12b2896e20274e18d71888f0eda019e96872bd

  • SHA256

    8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8

  • SHA512

    d46d9fa56d0b1c044d7b12ba79bdb75e035b8fffca97872ca1a7a74041e7cc091e49a571fe8c1f57b547b5f264f573b4fd905411b21598e3815bc907f6d9f261

  • SSDEEP

    1536:PPy5jS/dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96V9/n17mQ:PPy5jSen7N041Qqhga9/J

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe
    "C:\Users\Admin\AppData\Local\Temp\8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zr1cdr0h.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES372D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD82972DFEBE24FF6B44C1782B2A0A25C.TMP"
        3⤵
          PID:100
      • C:\Users\Admin\AppData\Local\Temp\tmp3662.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp3662.tmp.exe" C:\Users\Admin\AppData\Local\Temp\8c5cdae9cb74570d70fde6349a82a1a72484e930edc003db700e1005c18d98d8.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:3316

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES372D.tmp

      Filesize

      1KB

      MD5

      1594e14faa6b9a419ef51ef3bdc33440

      SHA1

      4be649a8e1c8aa9a3f93f35c7b066f1e48c7e1ba

      SHA256

      b1a59a4e3691f8dba505d9bdab5f03165f9940b9d4b62fe2d13496298c4eac1c

      SHA512

      c7f91e8323ed9fb3f69cd3cc048fdcb223c425afd261b7ea43985172dc8bc3850b847420323ba86229cc0a75a933ac7d554d215dcaa07929873f416571d923a3

    • C:\Users\Admin\AppData\Local\Temp\tmp3662.tmp.exe

      Filesize

      78KB

      MD5

      7f06c2d19f253fa1728a33115459f989

      SHA1

      3533a3e4c2e5594c52c57a7ab2e3e0227e546e40

      SHA256

      5eda6d03065a63a873f0611f94c72ca9ee416d64cb3547355ca1a7536eb64eb6

      SHA512

      e102893ff1f275f9b964266015fa42596e9117b0b7488c1480840210d9795d8bee576da626a90828aa158687cc20163a9adba05d5916583abc234325b58bcff8

    • C:\Users\Admin\AppData\Local\Temp\vbcD82972DFEBE24FF6B44C1782B2A0A25C.TMP

      Filesize

      660B

      MD5

      b1553496892911a4a27d2ba942515085

      SHA1

      bea09ae3f3e67188041574d75d2e23daeeba5499

      SHA256

      28cd7862342a930af8325e878bac1a6b9c4317c41ee672695187a2f33bd40f87

      SHA512

      c287f50401ff863aa4e78d9cf0d2dd6da0ba6b1bc05777c7984239f3f9f1976d162d7569453a7d465de74aa2c823d6d69e22fda6d24d9f57febefa3b84baab20

    • C:\Users\Admin\AppData\Local\Temp\zCom.resources

      Filesize

      62KB

      MD5

      aa4bdac8c4e0538ec2bb4b7574c94192

      SHA1

      ef76d834232b67b27ebd75708922adea97aeacce

      SHA256

      d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

      SHA512

      0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

    • C:\Users\Admin\AppData\Local\Temp\zr1cdr0h.0.vb

      Filesize

      14KB

      MD5

      87e95cd471ec341640b222d6b07887c1

      SHA1

      f394065cfa6fae1e8b8374fbd31f763326f5abf3

      SHA256

      a08ee8d7eed1ff1f8b271c459ab7827aefbda960a28d3ea90554ee2fbf650115

      SHA512

      9d5954561ff89edc3a5cb9777e182f3f98468668b6565f85d78f9244d52cf603213f9e78fb76df0ba5bfb0e269085951934dac236b6bb02fbdd5800ec3f7c7c2

    • C:\Users\Admin\AppData\Local\Temp\zr1cdr0h.cmdline

      Filesize

      266B

      MD5

      fa517438f1e7b1bf4eecb51efa7aeaed

      SHA1

      f0d985a1580a0f2c1e949c0467f8bea5cb5d5067

      SHA256

      1081bb6246e1f4252eb82dc989311024e6d8d4a11af61ed82d91d71e4d0e8137

      SHA512

      0a28d19fc377ca44164684f1b9398e3a78083b64ffd175864624b78ebec286f982fda181565a0199fae9ae351dbf62b591ae2422ebfdf47f93b147e544858012

    • memory/1212-8-0x0000000002610000-0x0000000002620000-memory.dmp

      Filesize

      64KB

    • memory/3316-23-0x0000000001790000-0x00000000017A0000-memory.dmp

      Filesize

      64KB

    • memory/3316-22-0x0000000074EF0000-0x00000000754A1000-memory.dmp

      Filesize

      5.7MB

    • memory/3316-24-0x0000000074EF0000-0x00000000754A1000-memory.dmp

      Filesize

      5.7MB

    • memory/3316-26-0x0000000001790000-0x00000000017A0000-memory.dmp

      Filesize

      64KB

    • memory/3316-28-0x0000000001790000-0x00000000017A0000-memory.dmp

      Filesize

      64KB

    • memory/3316-27-0x0000000074EF0000-0x00000000754A1000-memory.dmp

      Filesize

      5.7MB

    • memory/3316-29-0x0000000001790000-0x00000000017A0000-memory.dmp

      Filesize

      64KB

    • memory/3572-0-0x0000000074EF0000-0x00000000754A1000-memory.dmp

      Filesize

      5.7MB

    • memory/3572-2-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

      Filesize

      64KB

    • memory/3572-1-0x0000000074EF0000-0x00000000754A1000-memory.dmp

      Filesize

      5.7MB

    • memory/3572-21-0x0000000074EF0000-0x00000000754A1000-memory.dmp

      Filesize

      5.7MB