metamorpherrat | 7585a46378ada9731344f3512b22d52bb324e20cf08562488371f187c2f30cc1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe
Size 78KB
Sample240407-m7n6xsbf92
SHA256 7585a46378ada9731344f3512b22d52bb324e20cf08562488371f187c2f30cc1
MD5 e4c6f58dd23f7d8de42328c0d7efc696
SHA1 703843ec5e540fd265b9d741ae9142eb0dfc09e7
SHA512 f7b54c893af204832adf1165d7e0fd18e8b6109ad53a69c972f29c91bf7c25a80c048ed8ec8024207fa96651bfe7c2dcbd3af28301d0dd06af3ea694aaf56da9
SSDEEP 1536:kPy5jSZLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQti6x9/l1MI:kPy5jSxE2EwR4uY41HyvYp9/l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
5036	tmp3558.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp3558.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3780	e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe
Token: SeDebugPrivilege	5036	tmp3558.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 2072	3780	e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe	89
PID 3780 wrote to memory of 2072	3780	e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe	89
PID 3780 wrote to memory of 2072	3780	e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe	89
PID 2072 wrote to memory of 3860	2072	vbc.exe	91
PID 2072 wrote to memory of 3860	2072	vbc.exe	91
PID 2072 wrote to memory of 3860	2072	vbc.exe	91
PID 3780 wrote to memory of 5036	3780	e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe	92
PID 3780 wrote to memory of 5036	3780	e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe	92
PID 3780 wrote to memory of 5036	3780	e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fxwpxzkz.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3614.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc61C976BAC19B40459A8AA0E4EDA1A8C.TMP"
    3⤵
    PID:3860
- C:\Users\Admin\AppData\Local\Temp\tmp3558.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3558.tmp.exe" C:\Users\Admin\AppData\Local\Temp\e4c6f58dd23f7d8de42328c0d7efc696_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3614.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3614.tmp
Size 1KB
SHA256 e036b24293598934a9115d4580f16527e99b5a3102b72a39f92615a4ed2346bf
MD5 649a1fa21b6cd1327af04ca4a9a34cfb
SHA1 724d945b75a0e260f4f2914f376f06080bc0ddd0
SHA512 a55a93ef4befb72880f509f0a4a964dad7494586ead21a4dd388993d3ac562350ed04af6698d1a405f413d284f765819f949b169e54ece2544276876999aad85
MD5 SHA1 SHA512

Submit Download

fxwpxzkz.0.vb

Path C:\Users\Admin\AppData\Local\Temp\fxwpxzkz.0.vb
Size 14KB
SHA256 583f13bf6d3524567929df4e7c30fa92e8c8b92a657744aba215f65aaa2260aa
MD5 aefb695a5d8ec814581693a35af9bf0d
SHA1 274615dbc051515669a378b1c0ad0de50a54ac29
SHA512 fbedb70a4e80acdc8d08a9ae98e45118c204308fdfecadd992ae8227bc858ac34974d3a5460669fa86b0881cd24be168f11d4d0746a06759570b18d867e4c3b9
SSDEEP 384:rxNvLND2NANdbdj2NkNicHbwE6NzMzN7QrSN7eP:fv52oaEicHwzMhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

fxwpxzkz.cmdline

Path C:\Users\Admin\AppData\Local\Temp\fxwpxzkz.cmdline
Size 266B
SHA256 f99c1e0b99ee9494cb2fca3ec197976b184f578a06eca4cbb682e0648be7ac88
MD5 ffec69335139e29f686a12eb35be85f6
SHA1 dffacc229fbec5a9f32378d47e8e309f33186d0c
SHA512 7ac46c64232cd67eda94f1b7e5d2d8d57edd11949e95ce06f70da2833cf16c61650334246ae72ff912e40d38c06c1ea906922a91adb21047c5bd29eca6765c90
MD5 SHA1 SHA512

Submit Download

tmp3558.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3558.tmp.exe
Size 78KB
SHA256 810daf2fb014a74ddc4414fb0321f385b73b75665f61e8297f1168bf5954cdad
MD5 9bb8dd146baf4d47bc876eba6528840b
SHA1 72fed79c923baadf1a57835a13f558e4e7e4c988
SHA512 ca587258fe117bf8555e2dfbf714e746feec4f42338959dda4ce4b7de58c690444ce77999172fb98a55a5bc2683f595fb552721d98a2d42732475ad8f167e6da
SSDEEP 1536:yPWtHF3rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQts9/v1br:yPWtHFbdSE2EwR4uY41HyvYs9/t
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc61C976BAC19B40459A8AA0E4EDA1A8C.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc61C976BAC19B40459A8AA0E4EDA1A8C.TMP
Size 660B
SHA256 4b89980a8150fbeb902eae40adc400b2746bd84cae153c304bad3941bc1b7dca
MD5 b4120b885f4b9f2e1a66c2e38ba5ee4e
SHA1 6c9d3eaf52d6bb1751f30482b7dfca303935c1a8
SHA512 740094e67eca6e8477c03b537e5964466d232190ce5d281a1719427db3d72604628f51c3a25866df82225f6af2579495849d58624d1af49c869ac3d6b1c0bcfe
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3780-2-0x0000000001840000-0x0000000001850000-memory.dmp

Download

memory/3780-1-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/3780-0-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/3780-20-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/5036-21-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/5036-22-0x00000000011D0000-0x00000000011E0000-memory.dmp

Download

memory/5036-23-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/5036-25-0x00000000011D0000-0x00000000011E0000-memory.dmp

Download

memory/5036-26-0x00000000750B0000-0x0000000075661000-memory.dmp

Download

memory/5036-27-0x00000000011D0000-0x00000000011E0000-memory.dmp

Download

memory/5036-28-0x00000000011D0000-0x00000000011E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads