metamorpherrat | f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b

Analysis

max time kernel
166s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
533e73f658e25e20e180b9045ce845b2.exe
Size 78KB
Sample240409-2jth3aaf8w
SHA256 f056d4c1f5d092f69f43e0de63be99d70ffa7e4edf55cc20df05a76ef5f7ac9b
MD5 533e73f658e25e20e180b9045ce845b2
SHA1 2c48314e5ff97d22abf37644f7dd25b228cbfaff
SHA512 a46d7b824607c310343f1890de1fc070cd44b8abc672275b7f6a9e0b81ddcd213c34742c4007e9ffcd654789339960e9cdd6fb9cf96c529ab508d1de748733cd
SSDEEP 1536:ye5jSdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96g9/M1C0:ye5jNn7N041Qqhgj9/K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	533e73f658e25e20e180b9045ce845b2.exe

Executes dropped EXE 1 IoCs

pid	Process
2056	tmpB565.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmpB565.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	533e73f658e25e20e180b9045ce845b2.exe
Token: SeDebugPrivilege	2056	tmpB565.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3232	2776	533e73f658e25e20e180b9045ce845b2.exe	88
PID 2776 wrote to memory of 3232	2776	533e73f658e25e20e180b9045ce845b2.exe	88
PID 2776 wrote to memory of 3232	2776	533e73f658e25e20e180b9045ce845b2.exe	88
PID 3232 wrote to memory of 1124	3232	vbc.exe	90
PID 3232 wrote to memory of 1124	3232	vbc.exe	90
PID 3232 wrote to memory of 1124	3232	vbc.exe	90
PID 2776 wrote to memory of 2056	2776	533e73f658e25e20e180b9045ce845b2.exe	92
PID 2776 wrote to memory of 2056	2776	533e73f658e25e20e180b9045ce845b2.exe	92
PID 2776 wrote to memory of 2056	2776	533e73f658e25e20e180b9045ce845b2.exe	92

C:\Users\Admin\AppData\Local\Temp\533e73f658e25e20e180b9045ce845b2.exe
"C:\Users\Admin\AppData\Local\Temp\533e73f658e25e20e180b9045ce845b2.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kb7dofuw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6DC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE162A4E3991641CEA62ED6FC4E7724.TMP"
    3⤵
    PID:1124
- C:\Users\Admin\AppData\Local\Temp\tmpB565.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB565.tmp.exe" C:\Users\Admin\AppData\Local\Temp\533e73f658e25e20e180b9045ce845b2.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESB6DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB6DC.tmp
Size 1KB
SHA256 995805866a9d3a7e02e53e305dd2466139ecd09da8d5158cb720178ee46254f4
MD5 07ad441c8aaf09f21b8494b2917f9cff
SHA1 cf12b6a539aa949546c86623b716e92f628f6167
SHA512 0759a328bed3a4ad4a0dd2d4934c4bff7c9ec895627692c8dad21e25ff3d029aa67e93cfa7e9828a08ee57c08bda45a698b2deeeec33783f8fbeec10d905fa3d
MD5 SHA1 SHA512

Submit Download

kb7dofuw.0.vb

Path C:\Users\Admin\AppData\Local\Temp\kb7dofuw.0.vb
Size 14KB
SHA256 d903ffd4c904c46517a7a24551897bdf8c0c41ac377cf6c584ffd073de3f25e8
MD5 af4b12c61c4adcc5a2dba03ebd69fedb
SHA1 55fe56a35f4479103de429df9e6631a953f04967
SHA512 bb8710bed306c8f51cbf2c4fca41eb03e18b8e15b3599fe5ba99a8e064c2ce6a1220b980b13317810f2915d0e44355ba83eb4630614283087196724df46c7543
SSDEEP 384:rBVNMNywNvNPVlniN0NQcHb+E6NLzN7QZSN7eP:dnMy4Vtlu0QcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

kb7dofuw.cmdline

Path C:\Users\Admin\AppData\Local\Temp\kb7dofuw.cmdline
Size 266B
SHA256 682f6e336ce9260eada226d984f9a12eb7fff60e2f8d5a95541ea5e0293efc73
MD5 cae731d0dd975fd187ff4623e5605411
SHA1 36cee2ed14095ddbef490a6e50bddfb6495aaa0e
SHA512 83c9c36c4509a7b2da076fdba010b2043d9d2f162b3742d3a0e47ea1a27962864559f34f744f7c7cf63c8a127ae03f4fd20947f8ea6c14b72ad01fe451c17769
MD5 SHA1 SHA512

Submit Download

tmpB565.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpB565.tmp.exe
Size 78KB
SHA256 ac5c9580d0309fbfa108a824c305a850411b7f448a5bb4ca87f9fdc66e2ac6f1
MD5 001732e7d7026e54f46fa2290df9f84b
SHA1 29688c931ba0b071fec975e71be73c95626e8b05
SHA512 f0c15ccef4feca4cb14ebba7469895afba260a5dd37e9e4845e57295df35536541e9d35dc79d2493d3545eb2febc45b662cf5623924ee80dda34384e99532c6b
SSDEEP 1536:IPCHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQto9/w1Yw:IPCHa3Ln7N041Qqhgo9/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcE162A4E3991641CEA62ED6FC4E7724.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcE162A4E3991641CEA62ED6FC4E7724.TMP
Size 660B
SHA256 f30c4fb8ac06eddc7918aee90ac462a90ed025d44138c9c9c253a15f31a1a7d9
MD5 c64da5017f63f23f8c2b7c8ead32b6ff
SHA1 1fe4c3b8ddadb32ff681876fd52f7603206b96cc
SHA512 5c1ac71c5170a49e4477dbdfa0fed40c3e88db00301ab559e8b80217a4335a18d086e0d30d2a48bcefa7ed9f740a73f22619dba88cc8a4089d5ea16de94a7b98
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2056-23-0x0000000001100000-0x0000000001110000-memory.dmp

Download

memory/2056-22-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/2056-24-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/2056-26-0x0000000001100000-0x0000000001110000-memory.dmp

Download

memory/2056-27-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/2056-28-0x0000000001100000-0x0000000001110000-memory.dmp

Download

memory/2056-29-0x0000000001100000-0x0000000001110000-memory.dmp

Download

memory/2776-2-0x0000000001050000-0x0000000001060000-memory.dmp

Download

memory/2776-1-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/2776-21-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/2776-0-0x00000000754C0000-0x0000000075A71000-memory.dmp

Download

memory/3232-8-0x0000000000B20000-0x0000000000B30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads