Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08-04-2024 19:44

General

  • Target

    2bde7491c0540ca8499ae986fcc082d7d938bb0dd8ccfb4eabf859c90ba35dba.exe

  • Size

    78KB

  • MD5

    7610fdebc9263ef8a369d1602b36d2f9

  • SHA1

    6a989b25e91bc1b80c6a4ca435aca9ba886c18a1

  • SHA256

    2bde7491c0540ca8499ae986fcc082d7d938bb0dd8ccfb4eabf859c90ba35dba

  • SHA512

    6aff82bce3277181101913f5c6c8b52d7b446c3a583f041466c7049d4119df2df13ad3c5ed14c1917a7f0821ea8ce88dfbcef79db4edf8ffda78efce45227c60

  • SSDEEP

    1536:6y5j5dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6G9/gV14l:6y5jkn7N041Qqhg+9/H

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bde7491c0540ca8499ae986fcc082d7d938bb0dd8ccfb4eabf859c90ba35dba.exe
    "C:\Users\Admin\AppData\Local\Temp\2bde7491c0540ca8499ae986fcc082d7d938bb0dd8ccfb4eabf859c90ba35dba.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jc4u20th.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA111.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA100.tmp"
        3⤵
          PID:2868
      • C:\Users\Admin\AppData\Local\Temp\tmp9DF4.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp9DF4.tmp.exe" C:\Users\Admin\AppData\Local\Temp\2bde7491c0540ca8499ae986fcc082d7d938bb0dd8ccfb4eabf859c90ba35dba.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:2680

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESA111.tmp

      Filesize

      1KB

      MD5

      d098314cb303dc8da5ce342de7bd2b61

      SHA1

      8f4e38ce6fe1b6399d3e209d35f08f10c5ee7533

      SHA256

      5cca08c9630b1a9a434dc127b7d818f937d8b5be5cfb3a9083c343397883866c

      SHA512

      85a9bb3d565f3173258900e226085fe0708007af13bbd1563f9090aa61393014599f1283b59636a96e08d42c69ead422dfcdbfac6b0f6484d22e215c051e8cd4

    • C:\Users\Admin\AppData\Local\Temp\jc4u20th.0.vb

      Filesize

      14KB

      MD5

      4882f251bbcc6a181944aa6f8d58e076

      SHA1

      7e4527ca82249c37c7542e796a6066c4741e0a82

      SHA256

      0cd988fcefb3e745673aa11a762325cdfa990a3b8b820a4b12c0487afe58a75e

      SHA512

      dec5f8b4fc7e1b9cdc02294de83517ead9b5c7560a01125bf56571444827fea3edfd640972387a574bb5768b8b8c24e9f9f15df179c30512644a3b9094f9241b

    • C:\Users\Admin\AppData\Local\Temp\jc4u20th.cmdline

      Filesize

      266B

      MD5

      ffbc924085d1899bed499150aaa2a904

      SHA1

      64b7f5c83321d07e8cf0d96d2c42900ec9269069

      SHA256

      72dc49d5e5c427239adc8755517352f1fc6e14c2178c30a1c56bd42fc1bc5769

      SHA512

      c9cf43ca349a784244dfc0969509e69d79abdd4d8206d42cbffb78e57b3ba986b5043d568184e9a1da561ba37fc04d72985192ba7a2641f5681fdc62012d6d9f

    • C:\Users\Admin\AppData\Local\Temp\tmp9DF4.tmp.exe

      Filesize

      78KB

      MD5

      a1e42933b9249d45f8564a9b7ece23ac

      SHA1

      cbd16019d4e0ad9d898f7b493bc7627f0687cb53

      SHA256

      be9692991ee5295bfe385bdde3bf650df783b9aa7f43e85ab5772fb55e8f52cf

      SHA512

      7374e144c8728ca36bf76fb093139ca1e61f4abcc3ea4874a42980f42f04a487bbf6c3e8853cd18676d641bba0d8503d0b03a027dde0612c7768884fb87cfe59

    • C:\Users\Admin\AppData\Local\Temp\vbcA100.tmp

      Filesize

      660B

      MD5

      6a00cce1944f90427cc355bc410cf8ac

      SHA1

      24aabf1c957d08d99e51b839689e9b868f96ee2c

      SHA256

      1e74fc192037046a0bdd0928cf5f985650b2ef3a55a23e5a33ed9d9746f2dc91

      SHA512

      ebe47043aacbdc2ddddfffde75ee8f05dacfce9a4e6cac25b7e0b0819dc65d19e8f4c5668485c66feb766e3129a201e62f1e4d64d7caae97f6f636b3a1cad043

    • C:\Users\Admin\AppData\Local\Temp\zCom.resources

      Filesize

      62KB

      MD5

      aa4bdac8c4e0538ec2bb4b7574c94192

      SHA1

      ef76d834232b67b27ebd75708922adea97aeacce

      SHA256

      d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

      SHA512

      0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

    • memory/1580-23-0x0000000074370000-0x000000007491B000-memory.dmp

      Filesize

      5.7MB

    • memory/1580-1-0x0000000074370000-0x000000007491B000-memory.dmp

      Filesize

      5.7MB

    • memory/1580-2-0x0000000000380000-0x00000000003C0000-memory.dmp

      Filesize

      256KB

    • memory/1580-0-0x0000000074370000-0x000000007491B000-memory.dmp

      Filesize

      5.7MB

    • memory/2480-8-0x0000000000250000-0x0000000000290000-memory.dmp

      Filesize

      256KB

    • memory/2680-24-0x0000000074370000-0x000000007491B000-memory.dmp

      Filesize

      5.7MB

    • memory/2680-25-0x0000000000B10000-0x0000000000B50000-memory.dmp

      Filesize

      256KB

    • memory/2680-26-0x0000000074370000-0x000000007491B000-memory.dmp

      Filesize

      5.7MB

    • memory/2680-28-0x0000000000B10000-0x0000000000B50000-memory.dmp

      Filesize

      256KB

    • memory/2680-29-0x0000000074370000-0x000000007491B000-memory.dmp

      Filesize

      5.7MB

    • memory/2680-30-0x0000000000B10000-0x0000000000B50000-memory.dmp

      Filesize

      256KB

    • memory/2680-31-0x0000000000B10000-0x0000000000B50000-memory.dmp

      Filesize

      256KB