metamorpherrat | f187c2edd53b11f3b7e309267c3128866baa444d1c9d363c11fe725f19b47f5d

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe
Size 78KB
Sample240412-a7ew2aac59
SHA256 f187c2edd53b11f3b7e309267c3128866baa444d1c9d363c11fe725f19b47f5d
MD5 eebe0a8ea893d6b546d8c4ee876e54ca
SHA1 784284c58b5c3ba6e3d36028aaa1f71b92c9af3d
SHA512 6a1462e2c8c877186bd033b1f988796a689260bb7a51779da8cc54b0eac3cf96b52815d4b6de51ea549c59b72e6009c5e680916a70348b74997ef9e5711293f1
SSDEEP 1536:HSV5OXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtN6g9/N1i0:HSV5GSyRxvhTzXPvCbW2UP9/P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2488	tmp6D12.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2488	tmp6D12.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp6D12.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe
Token: SeDebugPrivilege	2488	tmp6D12.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 1020	4964	eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe	84
PID 4964 wrote to memory of 1020	4964	eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe	84
PID 4964 wrote to memory of 1020	4964	eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe	84
PID 1020 wrote to memory of 4232	1020	vbc.exe	86
PID 1020 wrote to memory of 4232	1020	vbc.exe	86
PID 1020 wrote to memory of 4232	1020	vbc.exe	86
PID 4964 wrote to memory of 2488	4964	eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe	87
PID 4964 wrote to memory of 2488	4964	eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe	87
PID 4964 wrote to memory of 2488	4964	eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hlrdhp0t.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7DAC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D8344B747924CC398A9B3310D5FB71.TMP"
    3⤵
    PID:4232
- C:\Users\Admin\AppData\Local\Temp\tmp6D12.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6D12.tmp.exe" C:\Users\Admin\AppData\Local\Temp\eebe0a8ea893d6b546d8c4ee876e54ca_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7DAC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7DAC.tmp
Size 1KB
SHA256 b7450e645b008ea798c706bd1ead0892d66825b63d5ee96ccb77ddd5c150bbb1
MD5 4eee5ac3ee2921277628edeb92671b41
SHA1 ff234b8a148df8a8863bb03f810971d01cc5163d
SHA512 c95221fde022556ba20e10145e166a8504f5bde06f2bcfceb4ce90dbb68c463f6747717c271b35ed63603f3eafc47edbeacece1f7a27d7bad540956295c7e879
MD5 SHA1 SHA512

Submit Download

hlrdhp0t.0.vb

Path C:\Users\Admin\AppData\Local\Temp\hlrdhp0t.0.vb
Size 14KB
SHA256 efc4d68641424599a172ce3210a4f443d4dc9e1dd0172c6d5be7f82853db64cb
MD5 d0851b743d6349c282d56793f91a26a2
SHA1 48948a7ee1c405478fab54e66179b432324f3197
SHA512 1fd1bd652724a00f87646af4aee9bf8350678f1560b7e1e720e086f7d413d06441ad57adb0bea75b1c1c428e727e15da9ec473f7fdbe2dd60eb9576365d413db
SSDEEP 384:rB1fNLNpNeN3gckFzSNIgNLcHb4E6NUzN7QPSN7eP:d1l5jSQwBLcHQUhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

hlrdhp0t.cmdline

Path C:\Users\Admin\AppData\Local\Temp\hlrdhp0t.cmdline
Size 266B
SHA256 62de5e1723961a3faa741f8888e29ccf24c71e402320fe370a963ed3890039f6
MD5 62fdbbb467cd84afbd371f814dea7807
SHA1 5d30857e07b3600443964d051b8dc95e84e9b553
SHA512 1cb493fdb07de151273c9e5d8e75e864d5ef39179a0ade5393064e8f600aa9168a84fd17c39f0bc579d9ba41819c19764830950fe181b6a922bd663527e36c54
MD5 SHA1 SHA512

Submit Download

tmp6D12.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp6D12.tmp.exe
Size 78KB
SHA256 3e246b9ff8c3c01badae06b669c4239bd2d11d232d80ead218d3a5c4dc132895
MD5 40edca4bbf5de673bda320f39beef026
SHA1 480be74c62c28c130305f13a57c4d1dd8553a6a8
SHA512 f2f749533e764eaf7b2daac46b7e46eb0f56048c49b53f09ba9af38fed93c9c171ca49d02a274e97b0641064299d9d9ebd9f158f624e40de1518faab49420f56
SSDEEP 1536:VWtHHM7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQte99/L1Od:VWtHshASyRxvhTzXPvCbW2Ue99/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc3D8344B747924CC398A9B3310D5FB71.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3D8344B747924CC398A9B3310D5FB71.TMP
Size 660B
SHA256 abd97355d6bfc4f0cf8e7107fde139c7c636e00e9758ec456999a2959ae79479
MD5 4eda956993ce6579f94987153667de03
SHA1 9bc4f0531db729036d81531dfd3d9429b3fdd382
SHA512 b68bc511f26e4ee1546ec16f51a130999f0c88815da26e58f36743de8110a2445155d8e9b0571e9af01092d80ad640531301ab9c980e83c7c7ee72a69defefe5
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1020-8-0x0000000002560000-0x0000000002570000-memory.dmp

Download

memory/2488-22-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

memory/2488-23-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/2488-24-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

memory/2488-26-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/2488-27-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

memory/2488-28-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/2488-29-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/4964-0-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

memory/4964-2-0x00000000010F0000-0x0000000001100000-memory.dmp

Download

memory/4964-1-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

memory/4964-21-0x0000000074710000-0x0000000074CC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads