metamorpherrat | b67841f190d5eefa0af36bffcf65ac83f994479d912d50bc71ffa314d07236c9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe
Size 78KB
Sample240409-gp47jabf9t
SHA256 b67841f190d5eefa0af36bffcf65ac83f994479d912d50bc71ffa314d07236c9
MD5 e962fd27a0e66830e2f6697e3c263cb1
SHA1 3708b9d254841f47b1ae61897f3a6991ed955a4c
SHA512 4f3a35fc80c37c495a2ffddc3f0a23c46f81761ba00a355c039f99fbf4a6f399f14b90551487c064f798fdf79bde272f791792f685f636f587000609b8f8ced8
SSDEEP 1536:0PWtHFo6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtV9/n1J7:0PWtHFon3xSyRxvY3md+dWWZyV9/j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
3556	tmp4A96.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3556	tmp4A96.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\""	tmp4A96.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe
Token: SeDebugPrivilege	3556	tmp4A96.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 504	1896	e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe	87
PID 1896 wrote to memory of 504	1896	e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe	87
PID 1896 wrote to memory of 504	1896	e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe	87
PID 504 wrote to memory of 2916	504	vbc.exe	89
PID 504 wrote to memory of 2916	504	vbc.exe	89
PID 504 wrote to memory of 2916	504	vbc.exe	89
PID 1896 wrote to memory of 3556	1896	e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe	90
PID 1896 wrote to memory of 3556	1896	e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe	90
PID 1896 wrote to memory of 3556	1896	e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sxgynasr.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:504
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BCE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB52C49FAD3124654A7F75E7F15C926B.TMP"
    3⤵
    PID:2916
- C:\Users\Admin\AppData\Local\Temp\tmp4A96.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4A96.tmp.exe" C:\Users\Admin\AppData\Local\Temp\e962fd27a0e66830e2f6697e3c263cb1_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4BCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4BCE.tmp
Size 1KB
SHA256 8a92b8232cb3c92b9d36956c72c17ccd263c4c6785ef95b28fa7291855d9fb88
MD5 e0f0195f4b1d60faac4748c2d9f97865
SHA1 1eb5efa017c08b141ea7379226359921b73c0cd7
SHA512 adbcd3342b4c34750f1d964944c89311faa18b42dcd964395a80953c13e7b3ca1451e1f51cdcaa6a9af51e916b5150f3b2c61f3a21801652af7bf25d2b21a1ca
MD5 SHA1 SHA512

Submit Download

sxgynasr.0.vb

Path C:\Users\Admin\AppData\Local\Temp\sxgynasr.0.vb
Size 15KB
SHA256 fa15cafa8edac93cdea76bcb1f75ce0d56cd7b61d667cc2cb0b481fcc9cbc6c9
MD5 861d12b120aa4cb591956b8938840431
SHA1 7d15185a1e3a91a3722a076455a556997e49b0d5
SHA512 c60b2294661c54c1957d67de49af11823714befee1ba318783d6bd096432bf07f93f1dcf1186d3ea2eeeaee3f7473f84c3428090b51280a3bcd19d43228fbeeb
SSDEEP 384:rvNu5NPN1ENspcNONHcHbcE6NXzN7QfSN7eP:5w11kLiHcH0Xh++m
MD5 SHA1 SHA512 SSDEEP

Submit Download

sxgynasr.cmdline

Path C:\Users\Admin\AppData\Local\Temp\sxgynasr.cmdline
Size 266B
SHA256 e6ca65e7045218a69ca7e16aa54dd7881ca365f0d1b5f2dc0706fd173c18580e
MD5 778d7967d1e36d6b13d134d447c69bd7
SHA1 a71277c3b5c363c6e0be726d559a0f9ebcd735a7
SHA512 38826844a9ebd2381956b7c14c36c75a85f7a81666c9bbabfef2faf6b55ce04b9d4c659d9b75ca1962604acafca20a4a28d207f4153810ed4d900f768d1de1b6
MD5 SHA1 SHA512

Submit Download

tmp4A96.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4A96.tmp.exe
Size 78KB
SHA256 7250d5e83c47a27ec1da2ccd3443eaa68cdaa66884fcb11995faa168d7ae8a6c
MD5 43cde89534687077cc0433d3a3e63d5a
SHA1 a6570e3fb47227e389985654c5a7f8c28ad0228d
SHA512 677b592dbbd527b6000f75cfb8f5d7cf6bb279be2a98e748971c281a4f19b4405a617a9249664f2b9dfcc5951b63db5425c24e26c7910278f2c23ecc858e65a9
SSDEEP 1536:XV5jSIXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtC6i9/R1L3:XV5jSQSyRxvY3md+dWWZy69/f
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcB52C49FAD3124654A7F75E7F15C926B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcB52C49FAD3124654A7F75E7F15C926B.TMP
Size 660B
SHA256 61935f6d471f5bae0f2c9e792425006d475e2b7cdb666c2995306f1049684c10
MD5 a91b0807d83c091996fb0cd7ccca883e
SHA1 5f643fb80ca7b979ac983a452ad7f21213ea3faa
SHA512 a39702ea4693c337168ec4e4e57e35355dd6bfbda3b7c84a25a58d27bc632d23a3f54cb7949d375f6a3abbaf09df752f8c7239d423bf3051193131d9ef7d4dd8
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
MD5 4f0e8cf79edb6cd381474b21cabfdf4a
SHA1 7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4
SHA512 2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107
SSDEEP 1536:3XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtQ:nSyRxvY3md+dWWZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1896-2-0x0000000001760000-0x0000000001770000-memory.dmp

Download

memory/1896-1-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/1896-0-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/1896-20-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/3556-21-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/3556-22-0x0000000001760000-0x0000000001770000-memory.dmp

Download

memory/3556-23-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/3556-25-0x0000000001760000-0x0000000001770000-memory.dmp

Download

memory/3556-26-0x00000000751F0000-0x00000000757A1000-memory.dmp

Download

memory/3556-27-0x0000000001760000-0x0000000001770000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads