metamorpherrat | f2fe64f487a40a76b52e459513a5b64827e7f1222343ce8953ae087264171bd1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe
Size 78KB
Sample240410-v38nrsab21
SHA256 f2fe64f487a40a76b52e459513a5b64827e7f1222343ce8953ae087264171bd1
MD5 eb9d83883aeb809ffeaede845a4e84f3
SHA1 e883cc67717319cab15f97018186e6cf216b633c
SHA512 fb958e97ed77aa1944f04a76c21171acab5100787542cfa52a328b293e9a3a6ebf44397fbd0f53967c4e942b18ea71b91dbcea9c9352323722bbddadb28bd6e2
SSDEEP 1536:HRWV5jSwXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtd6z9/r13E:HRWV5jSoSyRxvHF5vCbxwpI6Ws9/i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
560	tmp3EAF.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
560	tmp3EAF.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_perf2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mscordbi.exe\""	tmp3EAF.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe
Token: SeDebugPrivilege	560	tmp3EAF.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1276	4828	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	86
PID 4828 wrote to memory of 1276	4828	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	86
PID 4828 wrote to memory of 1276	4828	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	86
PID 1276 wrote to memory of 5060	1276	vbc.exe	88
PID 1276 wrote to memory of 5060	1276	vbc.exe	88
PID 1276 wrote to memory of 5060	1276	vbc.exe	88
PID 4828 wrote to memory of 560	4828	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	89
PID 4828 wrote to memory of 560	4828	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	89
PID 4828 wrote to memory of 560	4828	eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3ch2a8j9.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3FF7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc245BB70BC533456F962DA559A2347CC1.TMP"
    3⤵
    PID:5060
- C:\Users\Admin\AppData\Local\Temp\tmp3EAF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3EAF.tmp.exe" C:\Users\Admin\AppData\Local\Temp\eb9d83883aeb809ffeaede845a4e84f3_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ch2a8j9.0.vb

Path C:\Users\Admin\AppData\Local\Temp\3ch2a8j9.0.vb
Size 14KB
SHA256 d22e046cbe2cf4c7e40de5b8a4d97607cbcb96cd00581ba7905cab7b74be953b
MD5 8abfdc2f944bf28731e34dcdce3e0786
SHA1 bcfe175c0e7bf1d5a633887fcf0ed94e37aea9fd
SHA512 61970da203b35681d349fb963185a32de3e2239931ab9a5c6ea6d78b15db5db7d818331332052400e88dece8b5045f96bc3dac3a74dbb284c3a5c77fd3d72912
SSDEEP 384:riQNY6NbKNQ0N73VYNXN1cHbzE6NnzN7Q7SN7eP:RYm6FCd1cHrnhs+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

3ch2a8j9.cmdline

Path C:\Users\Admin\AppData\Local\Temp\3ch2a8j9.cmdline
Size 266B
SHA256 88c0639db136005d8fad40d05d3f747efb2f2ac16fe27087fc3757c268811b3a
MD5 0496df45e599c844eac63e268a42e953
SHA1 b52adaaf66e217024c8243493ca46deedb734f64
SHA512 305c70b949bd5d4241d49b64733ba98f3ea82faa4378ae713e1c3ee4d8a9bb647d62cf600776fa003ee17eababef75755fa413bdbf4aad6bedfd07dbfa05eb2b
MD5 SHA1 SHA512

Submit Download

RES3FF7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3FF7.tmp
Size 1KB
SHA256 16453acbd9b27a47696b26b1d2dfda28a85f97ac7943f7ecd3f3a4275c4c9d51
MD5 5d7c698514bf5892086dd40b6bf2b61e
SHA1 f8e73a4d7fa029e6deb8bbd9519d1414bf9cdcf7
SHA512 caadc454b59a86e61434d54cd0cb44ea29dd431f243ebf5b91862607e6258a726063ef2da0050222e68b7f56dce8361aacad66a4973574977c5c17068030d5b3
MD5 SHA1 SHA512

Submit Download

tmp3EAF.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3EAF.tmp.exe
Size 78KB
SHA256 b82b718d0382be04c9e9dbb7ce74c5e1d6bed067a406072548b4296612f280af
MD5 492952fcef344e7637d2647bb4fd273e
SHA1 6ad000529d38d560283c4d52599e1afaa3bc4c2a
SHA512 ab81856525bf306b260cd972443f19eb1f60d1d317b7fdb872ef3ac803eab17c97fc66f683e75af8734ef8efe754ca1a7c9048c61705f7524e020f5c2f7cb1fb
SSDEEP 1536:EWtHFo6JIdXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQt+K9/qzz1/r:EWtHFoOINSyRxvHF5vCbxwpI6W+K9/sB
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc245BB70BC533456F962DA559A2347CC1.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc245BB70BC533456F962DA559A2347CC1.TMP
Size 660B
SHA256 ef5616ffcb23a32bd2e00f09aea5fb9f9d466788b7d9a3de475c53d80914b43c
MD5 8d6dfda06b730d107d73fb91544a56bc
SHA1 19b4cea3a3024513408206edb50dc230164675c9
SHA512 5b654c6d0dec102653025d9d58edf732de698f57647ff696c067023464450244beb53ec452d4934529310d23a55a2b272e0ecbf1fce841ba9f1ba7255ccdb772
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e2eb52524ddfed5e52a54484b3fecdc9ebe24fb141d1445d37c99c0ab615df4f
MD5 097dd7d3902f824a3960ad33401b539f
SHA1 4e5c80de6a0886a8b02592a0c980b2bc2d9a4a8f
SHA512 bb77c3f7b9b8c461b149f540a0dab99fdde474484b046d663228d8c0f1b6a20b72892643935069dd74134c8ab8e8f26b6badc210a6929a737541b9861007fbe4
SSDEEP 1536:0XT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtQ:sSyRxvHF5vCbxwpI6WQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/560-27-0x0000000075010000-0x00000000755C1000-memory.dmp

Download

memory/560-28-0x00000000013F0000-0x0000000001400000-memory.dmp

Download

memory/560-29-0x00000000013F0000-0x0000000001400000-memory.dmp

Download

memory/560-24-0x0000000075010000-0x00000000755C1000-memory.dmp

Download

memory/560-22-0x0000000075010000-0x00000000755C1000-memory.dmp

Download

memory/560-23-0x00000000013F0000-0x0000000001400000-memory.dmp

Download

memory/560-26-0x00000000013F0000-0x0000000001400000-memory.dmp

Download

memory/1276-8-0x00000000021E0000-0x00000000021F0000-memory.dmp

Download

memory/4828-21-0x0000000075010000-0x00000000755C1000-memory.dmp

Download

memory/4828-0-0x0000000075010000-0x00000000755C1000-memory.dmp

Download

memory/4828-2-0x0000000075010000-0x00000000755C1000-memory.dmp

Download

memory/4828-1-0x0000000001810000-0x0000000001820000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads