metamorpherrat | fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2024, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe
Size 78KB
Sample240412-dr2bwagf6v
SHA256 fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02
MD5 e80bcf760febb4251a49ec8de86a2861
SHA1 959ab47a245196246aa4cd92b7b95778ea16eb8f
SHA512 81b66b189d404e9689d31c2c7c569c63c897cba696d27b4649a9ec7b78cb47c1432d766b5ed7ba30228f0df7d6980ee4e91f2f4fadc295cc0b8a2642ea4fcfe7
SSDEEP 1536:35jYdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96H9/g1QS:35jnn7N041QqhgQ9/u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe

Executes dropped EXE 1 IoCs

pid	Process
4640	tmp3354.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp3354.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe
Token: SeDebugPrivilege	4640	tmp3354.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3692	4072	fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe	84
PID 4072 wrote to memory of 3692	4072	fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe	84
PID 4072 wrote to memory of 3692	4072	fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe	84
PID 3692 wrote to memory of 3420	3692	vbc.exe	86
PID 3692 wrote to memory of 3420	3692	vbc.exe	86
PID 3692 wrote to memory of 3420	3692	vbc.exe	86
PID 4072 wrote to memory of 4640	4072	fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe	87
PID 4072 wrote to memory of 4640	4072	fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe	87
PID 4072 wrote to memory of 4640	4072	fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe	87

C:\Users\Admin\AppData\Local\Temp\fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe
"C:\Users\Admin\AppData\Local\Temp\fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\msr0vli2.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3400.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc951812BB90E8412C9F1ACC619B78D9EA.TMP"
    3⤵
    PID:3420
- C:\Users\Admin\AppData\Local\Temp\tmp3354.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3354.tmp.exe" C:\Users\Admin\AppData\Local\Temp\fac59f4ba4abfe36ea0cdbb31fbfec310f5413a6ab73f593663aa152669fdb02.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3400.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3400.tmp
Size 1KB
SHA256 4e6cd296e7ba7975bf0f4ae4dc1509841bee8da45b147fb132b5340af55f0f42
MD5 9594e102a9a90a1ae7ebeeb52540ab8f
SHA1 596e430c742b7ccfb93ea72b6f11bd6a6f285007
SHA512 0413bf8a6505e4eb81e1533a078a1629809745b9d600d1f4454cde1d259862a7831b55b95c66549785b2b64e85c145bdbe0dab3652822069a516e691654304b2
MD5 SHA1 SHA512

Submit Download

msr0vli2.0.vb

Path C:\Users\Admin\AppData\Local\Temp\msr0vli2.0.vb
Size 14KB
SHA256 7b4872ee83939f6c44977e905be70daec95301981bb27a96025210f2579ea975
MD5 7bdb130e7cf9dee56e7e8060ea8f5859
SHA1 4226227ddb9098b6a2661e30950b2f789d3dda4f
SHA512 5e4844db358b99ec5c01fe5a86e7e31f3db3ed60413ac5bf82acf9cc7df1846d2d1d90a95aaf57619cd128e50a89cd2f8fddb5dadb429dc71800b84f20708291
SSDEEP 384:rYNcN/zaNS3NxaVln1XNINucHb+E6NLzN7QZSN7eP:U8/6S9xelrwucHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

msr0vli2.cmdline

Path C:\Users\Admin\AppData\Local\Temp\msr0vli2.cmdline
Size 266B
SHA256 8c680ea62a0bd2117afdb9d2e955b71ee612ace3fd87a621111ead46d8292efa
MD5 544512f2f61f7d81727e44efe47f9dad
SHA1 18869388e5e16840b178b126ef7fc0011fa572fe
SHA512 763f7da8536a360229f43ed9522c9bf5d60b7a8fd02fccd5dfbe5828749ff3c1170a12eecf3a9ed54fe95ac725d255a068e7200136e98944d68aff03e24ddd96
MD5 SHA1 SHA512

Submit Download

tmp3354.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3354.tmp.exe
Size 78KB
SHA256 373782ff991e6c7052286f6df87e36766c4fb6090cf10687f85acab0b2f3f78c
MD5 9c85bc8d7f2cd9cc6b72b90a25466a04
SHA1 f4e97290d1a64710e5e6a2d8ffb6781f900337b5
SHA512 7e46a5a7a96a956ed9c8442cf57f769523c05570790c50b353ecbf7ebbcb3841d7c26312607dd0158abc3cb7df4a4b4d6f6f6787414f1963d0c24902e214ca99
SSDEEP 1536:YRCHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQteq9/f11y:YRCHFq3Ln7N041Qqhgeq9/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc951812BB90E8412C9F1ACC619B78D9EA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc951812BB90E8412C9F1ACC619B78D9EA.TMP
Size 660B
SHA256 391a31e987f82a165008a42971cbe44b212e03bd110bf2a498029fcdf7b27ba1
MD5 c9bb1de586ed7a934197867c76db21bd
SHA1 796ed9343c73f1f16d5f8d5a9f193c6a148b0871
SHA512 93d9b49a630a7611f1312fdc9152e27ea370867bab70cf18292e26cab157846284db78c44440880222bb75dda4da99ed44c443510a508ae3a5422ae01b22e2f1
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4072-2-0x00000000010E0000-0x00000000010F0000-memory.dmp

Download

memory/4072-1-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/4072-0-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/4072-20-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/4640-22-0x0000000001620000-0x0000000001630000-memory.dmp

Download

memory/4640-21-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/4640-23-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/4640-25-0x0000000001620000-0x0000000001630000-memory.dmp

Download

memory/4640-26-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/4640-27-0x0000000001620000-0x0000000001630000-memory.dmp

Download

memory/4640-28-0x0000000001620000-0x0000000001630000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads