metamorpherrat | 22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe
Size 78KB
Sample240407-x226psce44
SHA256 22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd
MD5 489c28346117bff8775f7bc03e031a01
SHA1 dfa5db753944597180ebff7bd4517ad5f0c5797b
SHA512 70a8c4be0af7b41ad2cac2aa46ead0e5fae7142b1c131cfad2945199632c7ee3313e205595c417d35fc241b0ccd9c3d5079e7b482ca6723d877f525d6cd3bf28
SSDEEP 1536:qCHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtea9/Y1cY:qCHa3Ln7N041Qqhgea9/8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe

Executes dropped EXE 1 IoCs

pid	Process
3920	tmp6A14.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp6A14.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe
Token: SeDebugPrivilege	3920	tmp6A14.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 1472	3576	22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe	87
PID 3576 wrote to memory of 1472	3576	22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe	87
PID 3576 wrote to memory of 1472	3576	22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe	87
PID 1472 wrote to memory of 4852	1472	vbc.exe	89
PID 1472 wrote to memory of 4852	1472	vbc.exe	89
PID 1472 wrote to memory of 4852	1472	vbc.exe	89
PID 3576 wrote to memory of 3920	3576	22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe	90
PID 3576 wrote to memory of 3920	3576	22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe	90
PID 3576 wrote to memory of 3920	3576	22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe	90

C:\Users\Admin\AppData\Local\Temp\22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe
"C:\Users\Admin\AppData\Local\Temp\22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oevv2rjk.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E86.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8C97F8D52E904A318B5029819EB7D1A2.TMP"
    3⤵
    PID:4852
- C:\Users\Admin\AppData\Local\Temp\tmp6A14.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6A14.tmp.exe" C:\Users\Admin\AppData\Local\Temp\22df46f11c1472546378ffd4b69269c8035abcdc34523613c18b0e8bd547c7fd.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7E86.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7E86.tmp
Size 1KB
SHA256 7755a8f04b852efcb76a8db8c9172a99f4ed8d378ff48f2d5abd6fffa56bf1d7
MD5 d98eb291b58e2bc633418dd761634de1
SHA1 0dbcc6bf863045069f3044d2f27dfca1a222face
SHA512 e45574ed71b120c1ae1d758e00e5f2a6f4c992fa2e135d36ed156397f92e1c3e44e10891d821fa58e3883aace6b9bd13adc768ff700d3cccd97515885e60714c
MD5 SHA1 SHA512

Submit Download

oevv2rjk.0.vb

Path C:\Users\Admin\AppData\Local\Temp\oevv2rjk.0.vb
Size 15KB
SHA256 a26cd768c78c350ec16895e13c9e18861c293fb5f4beb96596e68b01453e4b77
MD5 189b276bd04907658d464c11d12aac86
SHA1 600ff2300c4d5224516518ac45b46e09dd2d6486
SHA512 a0a0b769b04d9a83c086fb802de4519e1efad0755804a3805cd8456f0664bca9271cf456fa5a6f2c1dc5efbfbe9378e9b9db3852b0157a4ed822ef0d80d37e01
SSDEEP 384:rxNBNnNkNvemONiENNcHbpE6NqbiVzN7Q5SN7eP:P7NEWbikNcHRgiVhQ+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

oevv2rjk.cmdline

Path C:\Users\Admin\AppData\Local\Temp\oevv2rjk.cmdline
Size 266B
SHA256 5a1e933bc728242d668878e6ecb62ed53754e8c40a5d81fc20f6cbb2ba056c72
MD5 ffe6436382eb096e43558860cd454345
SHA1 7318ce46ce3eb6a29504c35ee746c80a824851b1
SHA512 92ff79b101303914a6932f00064e241994dbddbd78009a2b9ad25e568444fe4c1233cf710cac0f0b1f8431128104bec95551a74edfa6f9eee8ce0ae23d56d358
MD5 SHA1 SHA512

Submit Download

tmp6A14.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp6A14.tmp.exe
Size 78KB
SHA256 c88bbf72880c9766e3ce87f7eaf3418a89507e687ac5e5c9294553e5c23c56f3
MD5 b371e62e0008d7160b190f70573cec52
SHA1 ac59332bca5f3516787a07d3ff4615a39aac7c14
SHA512 b41b68146557d2a70d1cf840262113a65e1abe00076bee2bf151a0723fcac752644e994f48b9e2d0d5fd6573ada55ca63d566d5139df0a5c186e174193db8872
SSDEEP 1536:Dc5jSHdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96Bd9/ht1ep:Dc5jSGn7N041QqhgI9/hC
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc8C97F8D52E904A318B5029819EB7D1A2.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc8C97F8D52E904A318B5029819EB7D1A2.TMP
Size 660B
SHA256 2d133f003eaac9da81fcd992e529a44f8684a423c2f24c799749940d51a22047
MD5 6a045b5f4029ca0a0973f325e2bbf88d
SHA1 827547ff4d6b2280d06d909309a0006f6e4752ff
SHA512 d66722ccf9bac1c4d0fa8e2f13bd382c3db7b808fa4b200bc80c426357f9c4377999718bfd4ef7b4bf00fb4750d04add8d4008d1b73074cb9300431a6720c663
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1472-8-0x0000000002580000-0x0000000002590000-memory.dmp

Download

memory/3576-0-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Download

memory/3576-2-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Download

memory/3576-1-0x0000000001310000-0x0000000001320000-memory.dmp

Download

memory/3576-21-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Download

memory/3920-22-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Download

memory/3920-23-0x0000000001650000-0x0000000001660000-memory.dmp

Download

memory/3920-24-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Download

memory/3920-26-0x0000000001650000-0x0000000001660000-memory.dmp

Download

memory/3920-27-0x00000000749F0000-0x0000000074FA1000-memory.dmp

Download

memory/3920-28-0x0000000001650000-0x0000000001660000-memory.dmp

Download

memory/3920-29-0x0000000001650000-0x0000000001660000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads