metamorpherrat | d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe
Size 78KB
Sample240408-cez3lsdf34
SHA256 d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e
MD5 d5e438d5c28d8817b77f2e3893c5648d
SHA1 64bfba0f51eb646da49b40013a02668c5f553ac3
SHA512 cb18609831659429a649c92ab3f6b12c8b043cbe08c0c089b20df95fbeb53b7341a59728fd14ce4257cdab4460ad506997416d9d8951ce28d94ec92482b5b179
SSDEEP 1536:iPCHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ9/S1mC:iPCHY53Ln7N041QqhgQ9/m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe

Executes dropped EXE 1 IoCs

pid	Process
3100	tmp95B8.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp95B8.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe
Token: SeDebugPrivilege	3100	tmp95B8.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4020	4004	d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe	88
PID 4004 wrote to memory of 4020	4004	d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe	88
PID 4004 wrote to memory of 4020	4004	d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe	88
PID 4020 wrote to memory of 228	4020	vbc.exe	90
PID 4020 wrote to memory of 228	4020	vbc.exe	90
PID 4020 wrote to memory of 228	4020	vbc.exe	90
PID 4004 wrote to memory of 3100	4004	d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe	91
PID 4004 wrote to memory of 3100	4004	d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe	91
PID 4004 wrote to memory of 3100	4004	d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe	91

C:\Users\Admin\AppData\Local\Temp\d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe
"C:\Users\Admin\AppData\Local\Temp\d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zggyny_a.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9877.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc12D51EACE16D463881A9B7152B4CB0.TMP"
    3⤵
    PID:228
- C:\Users\Admin\AppData\Local\Temp\tmp95B8.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp95B8.tmp.exe" C:\Users\Admin\AppData\Local\Temp\d8b3080c6e5c4480da8f690a63498ab2fc6c275ac181b3e8145624864ab1f54e.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9877.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9877.tmp
Size 1KB
SHA256 8451552219b08b881c30eae9a31a24ae02ccdb43d69c40d59ec7391749607751
MD5 cdddd359871468d1c085087170e488b1
SHA1 51e4ad0121bd2a3210b615d541dc51f8c7f277bc
SHA512 3bf7e6a5c1fe38d3745bbc9572c9673a87c74eba8cdca2614684d3d480fe17d4648529eda75da712ec4988866799dc529b0ed375c93c334bd5b377a1673994a4
MD5 SHA1 SHA512

Submit Download

tmp95B8.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp95B8.tmp.exe
Size 78KB
SHA256 bd3981369cf2cc92f7be09865f1ebdfe3dccccc89489fab5ec5448f111e7e46d
MD5 56d63316eca2de05b3c5101cc49a02b7
SHA1 0f7c055941e1527b8d6637e669ac54244d43a652
SHA512 e85ae7f3510bd889a12035c90c79d7b049658a57fbc9ec583758c11c46567aa320276b6cc8bee5af0ae1c4ef19b10e9dbe67959c2c2409d0652ff9dfc802750e
SSDEEP 1536:ERWV5Ody0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6g9/J1Oz:ERWV55n7N041Qqhgo9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc12D51EACE16D463881A9B7152B4CB0.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc12D51EACE16D463881A9B7152B4CB0.TMP
Size 660B
SHA256 22c243aee2e8022b9b4cb0860e9eb499a8818eccf65ae97d273e6a7a855bc6d1
MD5 80bb7da641b09eb99e7708c259239a27
SHA1 bb3f1d5713b551ea38c5c792402b2911513d7aab
SHA512 f5c40f6f62c3839a419c9fa985c1b0edc69d0e9def8fe511447e93ba9d816da13472d22813d68a42884eb4d369b3d7274c9322fedea48c810c1e9c95bb4d5abe
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zggyny_a.0.vb

Path C:\Users\Admin\AppData\Local\Temp\zggyny_a.0.vb
Size 15KB
SHA256 8b2372bcb8eed59383af9ed5fd783ad9eb4b63df7e8c7d2f7dad8a561579d927
MD5 c87e312addaca667a248342317ee43e7
SHA1 2bb285f770ad6ebfcee602d98a86796e4092ba3c
SHA512 e6f83cb0c0e4a38cde032a56e9b0ba06b561489e15d72667fe149e8f9d08d7f30487bd8ee85c870525dd9fcdc95b11be9d6ddf32ab6f5ce87612db5339970a9d
SSDEEP 384:rkNUHyuNBzNHlN2Z4NUNOcHb3E6NuzN7QZSN7eP:Qubz3dUOcHHuhw+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

zggyny_a.cmdline

Path C:\Users\Admin\AppData\Local\Temp\zggyny_a.cmdline
Size 266B
SHA256 3b3c17f8e2bc00364fb028d0a6f0e95434b3241107659147c757f375e5047e42
MD5 3f32bee5d01ba8c9221fc86cc6abf01b
SHA1 b91abfe88437e02315ed274585aaa767a0d6041d
SHA512 ce01bba628d758573ac2a4a919199de931d9f72596121dfa223fc632ae5a73ea2fa75c457efb622b6da3697a4f115c3d452f91f543fd53f15c0e71009378e143
MD5 SHA1 SHA512

Submit Download

memory/3100-21-0x0000000074E20000-0x00000000753D1000-memory.dmp

Download

memory/3100-22-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Download

memory/3100-23-0x0000000074E20000-0x00000000753D1000-memory.dmp

Download

memory/3100-25-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Download

memory/3100-26-0x0000000074E20000-0x00000000753D1000-memory.dmp

Download

memory/3100-27-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Download

memory/3100-28-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

Download

memory/4004-0-0x0000000074E20000-0x00000000753D1000-memory.dmp

Download

memory/4004-2-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Download

memory/4004-1-0x0000000074E20000-0x00000000753D1000-memory.dmp

Download

memory/4004-20-0x0000000074E20000-0x00000000753D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads