metamorpherrat | bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe
Size 78KB
Sample240408-a7q93abf91
SHA256 bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528
MD5 119ed38d2bcf4b4f54a22beb497c1fcd
SHA1 4c2bfcef582d5fa86cce44ec2b78792a8352b0de
SHA512 690f58067776c3e0ddd2e6fdca1c7dd9d371f5c3965267089356e077a99adb06b71a399d1b527784c5758118b8d399bb707288af151c7a2f110b3f2093352a02
SSDEEP 1536:hCHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtL9/O1lC:hCHa3Ln7N041QqhgL9/T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe

Executes dropped EXE 1 IoCs

pid	Process
2404	tmp2D78.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp2D78.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe
Token: SeDebugPrivilege	2404	tmp2D78.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3796	4824	bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe	86
PID 4824 wrote to memory of 3796	4824	bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe	86
PID 4824 wrote to memory of 3796	4824	bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe	86
PID 3796 wrote to memory of 3312	3796	vbc.exe	88
PID 3796 wrote to memory of 3312	3796	vbc.exe	88
PID 3796 wrote to memory of 3312	3796	vbc.exe	88
PID 4824 wrote to memory of 2404	4824	bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe	90
PID 4824 wrote to memory of 2404	4824	bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe	90
PID 4824 wrote to memory of 2404	4824	bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe	90

C:\Users\Admin\AppData\Local\Temp\bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe
"C:\Users\Admin\AppData\Local\Temp\bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2bvukfwn.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E92.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFDBCE2FC9A1E40D88C7F2DAE8F656454.TMP"
    3⤵
    PID:3312
- C:\Users\Admin\AppData\Local\Temp\tmp2D78.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp2D78.tmp.exe" C:\Users\Admin\AppData\Local\Temp\bb0f322478ec29069469df2cc12d80c1e11ae81b5c808b657408d09532354528.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2bvukfwn.0.vb

Path C:\Users\Admin\AppData\Local\Temp\2bvukfwn.0.vb
Size 15KB
SHA256 d6b9bc9da0d97e8998a436b349f1cfb4331744da8147eb5a7e5dac122a1deb99
MD5 9a7076894b519e595c9d11f41d9808a0
SHA1 85783ee9bc4459ef20c094d7e6edb60d0bc8d774
SHA512 358e16b9d76b032118673853d49784933f1d23bcef2fbfa28425cf98898b70bb181fe7fa435ef25cdad25439e321b4fc754188efb60cf745e816fc644ce66a37
SSDEEP 384:roN2NYNlNlVOBiENsNTcHbYE6NDzN7Q9SN7eP:8qgX0sTcHYDhw+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

2bvukfwn.cmdline

Path C:\Users\Admin\AppData\Local\Temp\2bvukfwn.cmdline
Size 266B
SHA256 0c02e8382e2d62b8f4390351b863d5d599fad01487e95283b69de35dbf7a0070
MD5 aad34f4af3576687f48a085da8a00e2c
SHA1 d7250ce96033f807d4eb583dfa46cbc60c66ab55
SHA512 8563ba73be704a5729a37c3648ad8ae77f4593a5beefb7a8f826c5926661b0eccd32c1de2963adc66b79f42dd497ebfa04d71ea77e4c4bfd82a15f43ce8b5169
MD5 SHA1 SHA512

Submit Download

RES2E92.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2E92.tmp
Size 1KB
SHA256 73d3426461460100819e077eeed8677bcdaf576d3a96fc971b6d727b9f450a2f
MD5 ab18c1a6b3b1d9c658bd58b5f161eb8d
SHA1 2c51962e17a8cd9702738371f4f17a905567fcb3
SHA512 087403cd7449842709d6218671f18d057c110e792c57f2db0aeeebbe53a639d947b373a7d1f71f5881c25bb2ac8a7d41571685defbdc3709a1af14b57a53779f
MD5 SHA1 SHA512

Submit Download

tmp2D78.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp2D78.tmp.exe
Size 78KB
SHA256 27c48e30690c4fd019fdacdfdf5b65e24d1b8d82683997036a587d3b84b5481e
MD5 2595b4ae825d4a7a8018f2244e8311c4
SHA1 7b7a7130b79405086b8e57d384b34d586c14fad7
SHA512 5498643d58a08d62108d15e568e426d07a98e51c6699b3a470975533be544259eda63fc332fab2cc8d47ca145c5491ccd05b1abe29d255405ced8faa0f30df1e
SSDEEP 1536:lRWV5jidy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6T9/SC1Ny:lRWV5j9n7N041Qqhgb9/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcFDBCE2FC9A1E40D88C7F2DAE8F656454.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcFDBCE2FC9A1E40D88C7F2DAE8F656454.TMP
Size 660B
SHA256 28e6be4198fbc9a94702a609383b628f7db7f50069a7898b2e6f513575bb74a5
MD5 1020e5c0cf552691b210f4d60ed94a7e
SHA1 d66d30ccc9eef9e3b4d14fab16ab8506e9d7cba7
SHA512 f61925cf79de76d9c709eb606011adb09a842abcc71511b89d4b8efb6bd2e340377f10cc46ea66564ea74e2a85e2e2d78e6973b810abbb37dea718efa9719e1e
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2404-23-0x0000000001090000-0x00000000010A0000-memory.dmp

Download

memory/2404-22-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/2404-24-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/2404-26-0x0000000001090000-0x00000000010A0000-memory.dmp

Download

memory/2404-27-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/2404-28-0x0000000001090000-0x00000000010A0000-memory.dmp

Download

memory/3796-8-0x0000000002440000-0x0000000002450000-memory.dmp

Download

memory/4824-2-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/4824-1-0x0000000001990000-0x00000000019A0000-memory.dmp

Download

memory/4824-21-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

memory/4824-0-0x0000000074780000-0x0000000074D31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads