Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08-04-2024 02:00

General

  • Target

    d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe

  • Size

    78KB

  • MD5

    d5e438d5c28d8817b77f2e3893c5648d

  • SHA1

    64bfba0f51eb646da49b40013a02668c5f553ac3

  • SHA256

    d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e

  • SHA512

    cb18609831659429a649c92ab3f6b12c8b043cbe08c0c089b20df95fbeb53b7341a59728fd14ce4257cdab4460ad506997416d9d8951ce28d94ec92482b5b179

  • SSDEEP

    1536:iPCHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ9/S1mC:iPCHY53Ln7N041QqhgQ9/m

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe
    "C:\Users\Admin\AppData\Local\Temp\d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mj1d4ouw.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E39.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3E38.tmp"
        3⤵
          PID:2996
      • C:\Users\Admin\AppData\Local\Temp\tmp3BE8.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp3BE8.tmp.exe" C:\Users\Admin\AppData\Local\Temp\d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:2508

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES3E39.tmp

      Filesize

      1KB

      MD5

      8554bd7b09032d6b48ec37d91202c925

      SHA1

      63675c1fe055e9dfb960db9ace6637169a5a2527

      SHA256

      6b75a90615cf9ff51d4b4cdb2ce24967bfef84cc63f7d617d73a458a3f456dc6

      SHA512

      51f4051d5f7fc869af824e71429921eddae77b43474c738861d9a31d1e736b7002223c284ac7fe16037b19f7355eaefde899d023e03fb19d8c5aa8b7712a5c45

    • C:\Users\Admin\AppData\Local\Temp\mj1d4ouw.0.vb

      Filesize

      15KB

      MD5

      4548e12a02cc1f752616bdf4a8b8e88b

      SHA1

      bed243f51575293e2654ec7729129b51f832d906

      SHA256

      4ceef0f0184b6ce9b4bb07e3294b29f83bfec7eed2dcc80146726bd74b5c95c4

      SHA512

      b2e7ce15e3fb4b381c081d68b116deadc072dd2543aefbae70ef1de2f7154c7acd720e093ad5f5725cba0ed47626993ebc04eb4037535d740798ad873bed7bab

    • C:\Users\Admin\AppData\Local\Temp\mj1d4ouw.cmdline

      Filesize

      266B

      MD5

      c995ffea880ae5effe711bcc31a67526

      SHA1

      f31c9c9957a34457a177e4c572b683e4205c7b7a

      SHA256

      5d2c914f5902cda377495a9bc2a8e1ea192f162a5e2e5f311e42165c22d45e16

      SHA512

      ab7d90b6615a850de599cde5a2a97cc4a80c98c523f3674f26b46a4a0b9636087214d375c2335f66beace1bd238215d673e14f79ca9e3d04f4ba4fc623b30203

    • C:\Users\Admin\AppData\Local\Temp\tmp3BE8.tmp.exe

      Filesize

      78KB

      MD5

      1be6f1cd434fa65f852a86340bbe6687

      SHA1

      e5d0a45ccaf55d3697ae4dad17b59f38b66ce085

      SHA256

      0f4d3f49e93ad5e9ff1a1e788c86bf8ad5f411680730b96d09df07a299f4df15

      SHA512

      1cbbc69dc6b46c6492e2cd0e4ed226427bb7aebfed194a6631fda4baac9b6fee29b10e078d63d0686c8f1e85be95324f817252327f8e50818c6280927270e550

    • C:\Users\Admin\AppData\Local\Temp\vbc3E38.tmp

      Filesize

      660B

      MD5

      e4f239da4b0f43dc254b23cb82a34001

      SHA1

      1d121f58e19e72228e4c1ab4149481efce89b5d2

      SHA256

      f141b19efefe27dc43a2873232e439f6e020f8233939eaea80738b3415418f81

      SHA512

      a43bade9bbdd661191490838c0191039b017d9ac769b289ecfcc088b784751ff41ffa62c89b3c002fdc81cd878d8fc5fd25046320aa05f82b154fad66f79ced3

    • C:\Users\Admin\AppData\Local\Temp\zCom.resources

      Filesize

      62KB

      MD5

      aa4bdac8c4e0538ec2bb4b7574c94192

      SHA1

      ef76d834232b67b27ebd75708922adea97aeacce

      SHA256

      d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

      SHA512

      0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

    • memory/804-23-0x0000000074F80000-0x000000007552B000-memory.dmp

      Filesize

      5.7MB

    • memory/804-1-0x0000000074F80000-0x000000007552B000-memory.dmp

      Filesize

      5.7MB

    • memory/804-2-0x0000000000320000-0x0000000000360000-memory.dmp

      Filesize

      256KB

    • memory/804-0-0x0000000074F80000-0x000000007552B000-memory.dmp

      Filesize

      5.7MB

    • memory/2508-25-0x0000000000540000-0x0000000000580000-memory.dmp

      Filesize

      256KB

    • memory/2508-24-0x0000000074F80000-0x000000007552B000-memory.dmp

      Filesize

      5.7MB

    • memory/2508-26-0x0000000074F80000-0x000000007552B000-memory.dmp

      Filesize

      5.7MB

    • memory/2508-28-0x0000000000540000-0x0000000000580000-memory.dmp

      Filesize

      256KB

    • memory/2508-30-0x0000000000540000-0x0000000000580000-memory.dmp

      Filesize

      256KB

    • memory/2508-29-0x0000000074F80000-0x000000007552B000-memory.dmp

      Filesize

      5.7MB

    • memory/2508-31-0x0000000000540000-0x0000000000580000-memory.dmp

      Filesize

      256KB

    • memory/2992-8-0x0000000001F30000-0x0000000001F70000-memory.dmp

      Filesize

      256KB