metamorpherrat | 8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/04/2024, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe
Size 78KB
Sample240412-3khnmabb4x
SHA256 8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300
MD5 758602c252d3ffba3d8ecda18d756ed9
SHA1 6fb37c127250b6fd07e7a5945b7d565cf6b0ab55
SHA512 1072ba45b624d364caa8443f09d78842492ca97a3aa49c4cae847106f6c7e80d34d26e6d10c531da0dce2967ee2ab4f7d98a8c2c33a667f06fa6bf232fd77ace
SSDEEP 1536:nPWV589LT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtd6T9/yw1D5:nPWV589E2EwR4uY41HyvYc9/y4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2556	tmp5486.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe
2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp5486.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe
Token: SeDebugPrivilege	2556	tmp5486.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 3016	2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	28
PID 2028 wrote to memory of 3016	2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	28
PID 2028 wrote to memory of 3016	2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	28
PID 2028 wrote to memory of 3016	2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	28
PID 3016 wrote to memory of 2632	3016	vbc.exe	30
PID 3016 wrote to memory of 2632	3016	vbc.exe	30
PID 3016 wrote to memory of 2632	3016	vbc.exe	30
PID 3016 wrote to memory of 2632	3016	vbc.exe	30
PID 2028 wrote to memory of 2556	2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	31
PID 2028 wrote to memory of 2556	2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	31
PID 2028 wrote to memory of 2556	2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	31
PID 2028 wrote to memory of 2556	2028	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	31

C:\Users\Admin\AppData\Local\Temp\8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe
"C:\Users\Admin\AppData\Local\Temp\8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qbjvdbuw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5726.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5725.tmp"
    3⤵
    PID:2632
- C:\Users\Admin\AppData\Local\Temp\tmp5486.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5486.tmp.exe" C:\Users\Admin\AppData\Local\Temp\8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5726.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5726.tmp
Size 1KB
SHA256 08a5928495aa1f676d58011cb3092a09c398e3f654f0efc22628794f5b29b6eb
MD5 2f3b693abf22d97fcf7ec6af8b3eb377
SHA1 96054fda14a2f1addf0973ea284e596648f9447d
SHA512 2d1578e34f48f4b55b821a72f7744980e71a0a43a362d4b2c3471591e6acc9af85b3e51f2b8bbf7e76caa98970cb479852b900c4d6e4c1792f8fc8064478675f
MD5 SHA1 SHA512

Submit Download

qbjvdbuw.0.vb

Path C:\Users\Admin\AppData\Local\Temp\qbjvdbuw.0.vb
Size 14KB
SHA256 c966ed58e37030f86581097f3719a9bc1329e7ecd010afceff18db90867f6d03
MD5 36bfed7eaa5cce5c062e635d567ac142
SHA1 647479986787dcf62920bcf4e25718b835bc3eea
SHA512 234235862e453aafc8b09a38ad0e8f5046e5898dd25292dfc6889db6481c753ac2b1166ed1c230e017a7edf674a377d18fded17cccf24274040442a2f55ad599
SSDEEP 384:rjNPZNsBNGN5bNicbdjOINkNZcHbwE6NzMzN7QrSN7eP:FLGGN3WwEZcHwzMhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

qbjvdbuw.cmdline

Path C:\Users\Admin\AppData\Local\Temp\qbjvdbuw.cmdline
Size 266B
SHA256 7d3d32dd5fb5856bbb0c417215c4bd889d09624416e0661fa081411f4c77c22d
MD5 791a908ca77dade009f51ffca71486e0
SHA1 f8c73649c2dcf391d63b3d64de4db5040b79e0d2
SHA512 7d4c2a0997420817a10d484b5c1b55a87a24b6e6973a0c96767b837f2351ba7d8f67a98c1e221a13de7424c1bcf35025c1af7c42fbaed1ace59a639270638c5c
MD5 SHA1 SHA512

Submit Download

tmp5486.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5486.tmp.exe
Size 78KB
SHA256 348c09e417b61d01b4139c45c1e07456d3f87767a201cd90f4510a568ec78478
MD5 d58b138993bf582a0d2098dac2a6d461
SHA1 e968e8b63607be89bab8fb27cfffd3aeed140b2c
SHA512 a03efe535b1c653b477ce963737dcd693a8aef78172853e19afe4f60a19160556f0dcc48b8ba61ddcd8b8b12aad90c2c9211fdbcc75f17d61c6a80714c65a152
SSDEEP 1536:d4tHY6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtkq9/W1v/:d4tHY8dSE2EwR4uY41HyvYkq9/0
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc5725.tmp

Path C:\Users\Admin\AppData\Local\Temp\vbc5725.tmp
Size 660B
SHA256 4eef3649e38e1e8d5c249e112bb35af1fbfcd19270015e7930e16fb934e2c75f
MD5 36a3c07246c86b0b704dbcf741e3cc4a
SHA1 1023c2f80042a20655d3be80b41b06831ce80203
SHA512 f1f14bfa7d2e9761023aaa72cfa3ebabaf137daf8c7005c495ef005dd79a686de218f0bfd9f7c5c5b15a5bf10bc6b6ee2990ce28d5dc92f3ddd5d16810433672
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2028-23-0x00000000741C0000-0x000000007476B000-memory.dmp

Download

memory/2028-1-0x00000000741C0000-0x000000007476B000-memory.dmp

Download

memory/2028-2-0x00000000006F0000-0x0000000000730000-memory.dmp

Download

memory/2028-0-0x00000000741C0000-0x000000007476B000-memory.dmp

Download

memory/2556-25-0x0000000000330000-0x0000000000370000-memory.dmp

Download

memory/2556-24-0x00000000741C0000-0x000000007476B000-memory.dmp

Download

memory/2556-26-0x00000000741C0000-0x000000007476B000-memory.dmp

Download

memory/2556-28-0x0000000000330000-0x0000000000370000-memory.dmp

Download

memory/2556-29-0x00000000741C0000-0x000000007476B000-memory.dmp

Download

memory/2556-30-0x0000000000330000-0x0000000000370000-memory.dmp

Download

memory/2556-31-0x0000000000330000-0x0000000000370000-memory.dmp

Download

memory/3016-8-0x00000000003B0000-0x00000000003F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads