metamorpherrat | 8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2024, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe
Size 78KB
Sample240412-3khnmabb4x
SHA256 8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300
MD5 758602c252d3ffba3d8ecda18d756ed9
SHA1 6fb37c127250b6fd07e7a5945b7d565cf6b0ab55
SHA512 1072ba45b624d364caa8443f09d78842492ca97a3aa49c4cae847106f6c7e80d34d26e6d10c531da0dce2967ee2ab4f7d98a8c2c33a667f06fa6bf232fd77ace
SSDEEP 1536:nPWV589LT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtd6T9/yw1D5:nPWV589E2EwR4uY41HyvYc9/y4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe

Executes dropped EXE 1 IoCs

pid	Process
4364	tmp5E6C.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp5E6C.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe
Token: SeDebugPrivilege	4364	tmp5E6C.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4660	4764	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	78
PID 4764 wrote to memory of 4660	4764	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	78
PID 4764 wrote to memory of 4660	4764	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	78
PID 4660 wrote to memory of 3628	4660	vbc.exe	80
PID 4660 wrote to memory of 3628	4660	vbc.exe	80
PID 4660 wrote to memory of 3628	4660	vbc.exe	80
PID 4764 wrote to memory of 4364	4764	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	81
PID 4764 wrote to memory of 4364	4764	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	81
PID 4764 wrote to memory of 4364	4764	8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe	81

C:\Users\Admin\AppData\Local\Temp\8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe
"C:\Users\Admin\AppData\Local\Temp\8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rhiskwjw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60EC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3F37C06E3F4E43C9B9B858D54FF67999.TMP"
    3⤵
    PID:3628
- C:\Users\Admin\AppData\Local\Temp\tmp5E6C.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5E6C.tmp.exe" C:\Users\Admin\AppData\Local\Temp\8c8e2517be2b51c94cb73f9451b478fdd27be848dd24f4ef9ab7bf1879522300.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES60EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES60EC.tmp
Size 1KB
SHA256 22a6f4054e4059705e7d5ea977ab864cac58b607d65dc6640c356c718ab117d0
MD5 58aeded1383167498cc4e9512137522f
SHA1 f60673d7d392bb666d17935d7d8f3c73ddaf2fb0
SHA512 88925d7300ce1d53523e0c9c97b7a472fa543704a4e96efb3b7463d60d5862d171285fe5ccb1b91aee625da96a5231a4b992bf603a71abdc772101410dece3b4
MD5 SHA1 SHA512

Submit Download

rhiskwjw.0.vb

Path C:\Users\Admin\AppData\Local\Temp\rhiskwjw.0.vb
Size 14KB
SHA256 49eed5bf062ec603d50193f9f563bcdb06bb5d7b766ada5a5a4e6be9a28268e6
MD5 37e770fe84caed105eec48411fb6e7fd
SHA1 6de3c7ceff88e8920313545ed30efb8e17e4ca95
SHA512 5685d9970853886888580a673d2645bbd5a511f22b89b192e3aaa596092e12e929922c16eee88e8678a940a02b4a6c1a441ef19c1b07554cdd20cdc97b542412
SSDEEP 384:rOaNVNP4N9V+NXbdj7zNlNJcHbwE6NzMzN7QrSN7eP:6GnYunXJcHwzMhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhiskwjw.cmdline

Path C:\Users\Admin\AppData\Local\Temp\rhiskwjw.cmdline
Size 266B
SHA256 3030bb76ca966511f3c6ac78d3a2ae43ba67f9a8fb363e127518e3e6ef513b48
MD5 a8652bfe2e6a4196a906c7399b139b15
SHA1 57648b89b149276d1376aa591f995f5ad17312ff
SHA512 4ba0d9e4a774774b451771a40e90961b6888c48aad3c47c69f99aacb0321816c9847599808cf4415809f29cd83a60b7f6ec10ca8437f6c70b1dfa26baec97b5d
MD5 SHA1 SHA512

Submit Download

tmp5E6C.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5E6C.tmp.exe
Size 78KB
SHA256 d3bbc2b3aa2f4908953dca5d7926633f179b7915bc22bfdffd38e2f19773c82b
MD5 f1ade3aaeb3ed9ce852151baa7c2767b
SHA1 f922a793c0c16157b80ee55d3408b5f46a368d5e
SHA512 388437015c885906e39bc5f085bc49c1512148e9c834018dfd008fa63d280d7b14054e48139ca52df85b598250042607ae9b582c6bb9e524d0f92dbf66e567ce
SSDEEP 1536:pStHFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLa9/alG:pStHFo8dSE2EwR4uY41HyvYLa9/z
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc3F37C06E3F4E43C9B9B858D54FF67999.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3F37C06E3F4E43C9B9B858D54FF67999.TMP
Size 660B
SHA256 e27de704dc128464789c7b7a8e6386ed7532b4d76396bad44ca561e033f703ed
MD5 b581afe25c32920348c5027b5228677a
SHA1 200626ce0aec52bb38e3acdaa3845cef2b2c1fe2
SHA512 60440df9a998deac93c86d3e4222f526e71a06bdea99cf43347538439ccd3502e2b54b0e332082ef8ef5018f7cd38729c239b2d6c9c6f01f59bcfa689b3ffa6e
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4364-23-0x0000000001190000-0x00000000011A0000-memory.dmp

Download

memory/4364-22-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/4364-24-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/4364-26-0x0000000001190000-0x00000000011A0000-memory.dmp

Download

memory/4364-27-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/4364-28-0x0000000001190000-0x00000000011A0000-memory.dmp

Download

memory/4364-29-0x0000000001190000-0x00000000011A0000-memory.dmp

Download

memory/4660-8-0x00000000006C0000-0x00000000006D0000-memory.dmp

Download

memory/4764-2-0x0000000001330000-0x0000000001340000-memory.dmp

Download

memory/4764-1-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/4764-21-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/4764-0-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads