metamorpherrat | 6013b8df312752922c449e0977753efceca566b1030f9904663cb7220f10f4ae

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 08:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe
Size 78KB
Sample240410-jwprjagh67
SHA256 6013b8df312752922c449e0977753efceca566b1030f9904663cb7220f10f4ae
MD5 ea9bd0e0af93469d88b0be36fd78a2db
SHA1 f05b628a9f8fe87f4eb5b2c1db6cb13df9ed50dc
SHA512 affd76ca4d44ad95f878df0f3dda7857b4bd6b727e3dcb19ccd20c26e89fd09477ecbf3231e4cb2e400295977b0256c76c54dcd71c58cfb72546c50228c7b76b
SSDEEP 1536:GhRWV58wXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt96U9/lf1/P:CRWV58oSyRxvY3md+dWWZyH9/D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3616	tmp4C4B.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\""	tmp4C4B.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe
Token: SeDebugPrivilege	3616	tmp4C4B.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 2804	4584	ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe	87
PID 4584 wrote to memory of 2804	4584	ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe	87
PID 4584 wrote to memory of 2804	4584	ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe	87
PID 2804 wrote to memory of 852	2804	vbc.exe	89
PID 2804 wrote to memory of 852	2804	vbc.exe	89
PID 2804 wrote to memory of 852	2804	vbc.exe	89
PID 4584 wrote to memory of 3616	4584	ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe	90
PID 4584 wrote to memory of 3616	4584	ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe	90
PID 4584 wrote to memory of 3616	4584	ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9bhzyozn.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D26.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc98B54ED31A9F4458A86D49B54991695B.TMP"
    3⤵
    PID:852
- C:\Users\Admin\AppData\Local\Temp\tmp4C4B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4C4B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\ea9bd0e0af93469d88b0be36fd78a2db_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9bhzyozn.0.vb

Path C:\Users\Admin\AppData\Local\Temp\9bhzyozn.0.vb
Size 14KB
SHA256 71eef00e9c529ec90558c1e697d263a303a4c5808ae51233df683e6d5c0f80b6
MD5 924c1a9c88e77a5f7a92d0a821e3e1a8
SHA1 311737ca2f0c563e3b375896fe9a3f27485035de
SHA512 852b28771170f8dad65511d03dfc1e8bbfc7d6daf153bd2af6b891fd0e0d341e2c539d58ee34e16eff853e8ab204b706344c282eb4737e5f260f30914c41bb06
SSDEEP 384:rqfNINUdNNNIKNVNXVNpcHbzE6NGzN7QKSN7eP:+lwefDJXpcHzGhB+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

9bhzyozn.cmdline

Path C:\Users\Admin\AppData\Local\Temp\9bhzyozn.cmdline
Size 266B
SHA256 dc30d5b071788fe92d20e869d340ca9284b56e8b22fa25e3fd747dceeedb478e
MD5 5a9d87bf81ab23cd6d6cd8eacd0a7561
SHA1 664b2db300c88b40c233f6d9eb0591468bce37df
SHA512 d5ddca6379bf638629f853c2609c63addec8789b4dfa28f93cca11d6983c221b1592be14f4ac85d5c700434a5beb77eb018560bff7fff37679e52f0bb916d2c2
MD5 SHA1 SHA512

Submit Download

RES4D26.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4D26.tmp
Size 1KB
SHA256 e20aaeef98771b6c5b0bc3fd216373493a6331a66b323df54de72ef69de27e45
MD5 a259506cb1633f2d0078f0e1034b968b
SHA1 30b49cdbb47c340c468d90b5554ec9e2440a4119
SHA512 bd88994a8b09aaebec694020d9d2483a1f144706bc934901ef9021b31a6f30e55f5e5837b8242fb689114c8b04d1e3d03dd1b1e9e4207a9b223a7ba142c0aea1
MD5 SHA1 SHA512

Submit Download

tmp4C4B.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4C4B.tmp.exe
Size 78KB
SHA256 d96588e9e38aa1da94cf09d11886412b354e61c94df69d441751ca421a1e3e89
MD5 3ea4350ca67bcb179a503185ba44db3b
SHA1 480beb9df65a589d61e58edd1a90d6bf99b5bde7
SHA512 207f556222b23876049f7a00a6d8a0c60fc00cbb2a73d3e1dc35856791345c64c455cb9022b8e181d64280eb67bfb430f3251eaa32d77780ff580d5b8b4da5eb
SSDEEP 1536:cWtHHM3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQteVH9/n1KX:cWtHs3xSyRxvY3md+dWWZyeVH9/u
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc98B54ED31A9F4458A86D49B54991695B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc98B54ED31A9F4458A86D49B54991695B.TMP
Size 660B
SHA256 4fa60a66051cb3ac219b76493fef3015235b2be11ab16a05a839260bbc01bb1f
MD5 9c2ebd7264ebd47c3e91d3e155fb37b0
SHA1 fcca16aa6214ce39739ce3d00eabd43988c3fd8d
SHA512 32fc28a167391208dbf5ac773694b704cbc03cf24fc163ddc97758f60ae3a5df80868e6a7e3e6bd3b1ad1b0736bd34161fe2cf56ea1054d2face3b720f92ae76
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
MD5 4f0e8cf79edb6cd381474b21cabfdf4a
SHA1 7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4
SHA512 2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107
SSDEEP 1536:3XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtQ:nSyRxvY3md+dWWZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3616-21-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/3616-22-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/3616-24-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/3616-25-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/3616-26-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/4584-0-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/4584-2-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/4584-1-0x0000000001650000-0x0000000001660000-memory.dmp

Download

memory/4584-20-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads