metamorpherrat | 793122bd1d2a248966abe74363e4db61945ad24b133c38f78db67da550cccd58

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe
Size 78KB
Sample240411-tvm7esae8w
SHA256 793122bd1d2a248966abe74363e4db61945ad24b133c38f78db67da550cccd58
MD5 edd8e3023a94a085a99a36ee52560605
SHA1 f8a619595e5b342746ea19a3ae066cdab4f495aa
SHA512 47f7eb6ffb3a2b1ed31c0ff4c1e2ea8f83798eb33ab63847ef589578f068006368de9bd8a2725aa59ea109d91e4601b2b2610a7c303351da0f346e1a743be9a4
SSDEEP 1536:XuHHM7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtep89/l1O0:XuHshASyRxvhTzXPvCbW2Uep89/v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4692	tmp3671.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp3671.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe
Token: SeDebugPrivilege	4692	tmp3671.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3212	3576	edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe	84
PID 3576 wrote to memory of 3212	3576	edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe	84
PID 3576 wrote to memory of 3212	3576	edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe	84
PID 3212 wrote to memory of 3196	3212	vbc.exe	86
PID 3212 wrote to memory of 3196	3212	vbc.exe	86
PID 3212 wrote to memory of 3196	3212	vbc.exe	86
PID 3576 wrote to memory of 4692	3576	edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe	87
PID 3576 wrote to memory of 4692	3576	edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe	87
PID 3576 wrote to memory of 4692	3576	edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0a_8vka7.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES374C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7EEC3B13848412D93F190BDA0336E4F.TMP"
    3⤵
    PID:3196
- C:\Users\Admin\AppData\Local\Temp\tmp3671.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3671.tmp.exe" C:\Users\Admin\AppData\Local\Temp\edd8e3023a94a085a99a36ee52560605_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a_8vka7.0.vb

Path C:\Users\Admin\AppData\Local\Temp\0a_8vka7.0.vb
Size 15KB
SHA256 e45df37a1205a29b341826410480e7604a9841d8fd211c7fd1c2bb0b1cb54192
MD5 f0af8e23953b711a1d2d5890d9f13f12
SHA1 390b61d6696d3506c62d2c443fbf933c5785524c
SHA512 a30f2809c2b442cb3f6154ab7f404299e20d56af36e1735a84f1bfd366ccd3ac025f39bd0e8621d06950500b61b89f914699ef779200fb8c9bf84b8afa834813
SSDEEP 384:r3NeNqxNI0b+NZXJNq7NTv5TNUcHbsE6NEzN7QqSN7eP:JSqL9byZXU/UcHEEhb+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

0a_8vka7.cmdline

Path C:\Users\Admin\AppData\Local\Temp\0a_8vka7.cmdline
Size 266B
SHA256 f79d8620b40721a48b4ae42c1968aacc4cd7942cdffaafeed16f05a313674117
MD5 893eb2362870f636b0f74194ac91c1e6
SHA1 70ee0ce6766d07b5d97c116edbed2546915a36a6
SHA512 82a51d0b6e431e8938fd80ac14db09bec354244b14e37dffa308c05c1c0000262242c4e3aa06082724072a3cab7a237666fbf1585b877b96df1da38388a0476b
MD5 SHA1 SHA512

Submit Download

RES374C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES374C.tmp
Size 1KB
SHA256 ef56cb7ced34a51025acb7f74da038f80f79b1af4bc0f2391bf651767de06990
MD5 9d5ba6f83c47424c0c90c10c31c461b9
SHA1 533ff9d6324eca38dc7c56289210b011d69d1494
SHA512 b29c7fd9639a851a956a3f0b994d4ce4a88feec393f30a8915dc954daf10e455ce7dea0391b06e5f5c226fbcb45ec51c8cb0ff5f60b1f82828fc4ff9195a3d93
MD5 SHA1 SHA512

Submit Download

tmp3671.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3671.tmp.exe
Size 78KB
SHA256 f678922f19c86f867cce139f762c43340b3067014dd2e70293de1f9b678d756d
MD5 bc2041a03e63aefa6f4283f78eedaa45
SHA1 536cc1801db4c6bb04c5cebf257f29a8d13725c9
SHA512 4b99413fb28085bbbded458e8cd52a87c261bff46949406362ca9f861e33cfe777e84c229d6cfd299763b0228afbe10a3ffc25a7eb415b8b7d36d67556fe4b7e
SSDEEP 1536:6e5OXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6n9/H1Yg:6e5GSyRxvhTzXPvCbW2Uf9//
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc7EEC3B13848412D93F190BDA0336E4F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc7EEC3B13848412D93F190BDA0336E4F.TMP
Size 660B
SHA256 05a9281e8a9d470aab7c22a9059350957201f008ec47834bc82230ebf4c94d0d
MD5 bfc14c97113e7bf86d735c4624cbbbc1
SHA1 94d97a4c96d6399d5bc2b825b355c82d44f72467
SHA512 2dc9df37ef061ff0069412f0fdb897bcf4fee7a6a73941a4cc3d571a2702055dba86a1759ddd19c7b63054481eccd57ed6bd7e02d937b87e20eab6f7da2b6aa7
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3212-8-0x0000000002240000-0x0000000002250000-memory.dmp

Download

memory/3576-0-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/3576-2-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/3576-1-0x0000000001410000-0x0000000001420000-memory.dmp

Download

memory/3576-21-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/4692-22-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/4692-23-0x0000000001960000-0x0000000001970000-memory.dmp

Download

memory/4692-24-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/4692-26-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/4692-27-0x0000000001960000-0x0000000001970000-memory.dmp

Download

memory/4692-28-0x0000000001960000-0x0000000001970000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads