metamorpherrat | 034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2024, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe
Size 78KB
Sample240412-wtymwace97
SHA256 034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8
MD5 fb782e0c22f0390758e3b8f51fd442d9
SHA1 b111418b6ced3d762153c5de5d0cabcad5d90a29
SHA512 7dc50fa64f4c3107821e01a4baf8037df017c0f88b481b3fc510df22ca103750a829c2216d101e5aa5da99a553dce6f9b76b50264a17a6604ad5dd92edd1a569
SSDEEP 1536:6SV5Sdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96O9/G1BM:6SV5Nn7N041QqhgB9/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe

Executes dropped EXE 1 IoCs

pid	Process
4928	tmp1085.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp1085.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe
Token: SeDebugPrivilege	4928	tmp1085.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 5076	4836	034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe	89
PID 4836 wrote to memory of 5076	4836	034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe	89
PID 4836 wrote to memory of 5076	4836	034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe	89
PID 5076 wrote to memory of 3188	5076	vbc.exe	91
PID 5076 wrote to memory of 3188	5076	vbc.exe	91
PID 5076 wrote to memory of 3188	5076	vbc.exe	91
PID 4836 wrote to memory of 4928	4836	034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe	92
PID 4836 wrote to memory of 4928	4836	034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe	92
PID 4836 wrote to memory of 4928	4836	034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe	92

C:\Users\Admin\AppData\Local\Temp\034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe
"C:\Users\Admin\AppData\Local\Temp\034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yoozj2ta.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1400.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc218234348D1F4711A33993D556903D9F.TMP"
    3⤵
    PID:3188
- C:\Users\Admin\AppData\Local\Temp\tmp1085.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp1085.tmp.exe" C:\Users\Admin\AppData\Local\Temp\034daecc6c4e0fba22c60b87419dab6ea4f62a6c6dfae0b8421672969859fda8.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1400.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1400.tmp
Size 1KB
SHA256 08d2199eb140a74f8b01bf3d2a9fb98f08ec00d1bc12f161cd9c037bd3e1abb4
MD5 13fdea8c2c1140c18beb42b92e29ac34
SHA1 534c84c055a6697e4d94716d3a83a214f7df4a20
SHA512 27e2c8faa24568b876bf0f75667ae0466ec61343ba769349df6853adeecc7953684c1811f5211c2d80b31a0c40d5cfe5af7588731d5a731770d48648c9545171
MD5 SHA1 SHA512

Submit Download

tmp1085.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp1085.tmp.exe
Size 78KB
SHA256 32b4a674a5626164711eca85324c018a898de8aa65a24ec470fa536dd6d62334
MD5 ef758236784c55caf9b2996168559dd7
SHA1 88cb8aa774e668f9926527ad6174d193f5597792
SHA512 acddb0de7aaf570f0339988548af09e7553f61ed0de8f9dc08a545a4bb9b61483f3b248ae817e18027c53d565060ab9e336609ec73ba061c26c74ad080f4039e
SSDEEP 1536:yHFo6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtid9/C1Ag:yHFo53Ln7N041Qqhgid9/K
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc218234348D1F4711A33993D556903D9F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc218234348D1F4711A33993D556903D9F.TMP
Size 660B
SHA256 6701cbb6b06b2a27b98e1f7ccf4f1948c2cba1b251b235d79a896fdbcdea6d50
MD5 34f8822f131e92f93e1f5e309f65ae51
SHA1 d078ad1a5cd6782b2144b75f564fbd4c85393210
SHA512 88427b07c0c8f0ffe9cf30a97c1e01efaae85c2dcd47d69cc86cfb7b9f4b9253c5dc270e4e33e6499987ac1cdbf798c27ef2080ed7e71393a39132734f3d6391
MD5 SHA1 SHA512

Submit Download

yoozj2ta.0.vb

Path C:\Users\Admin\AppData\Local\Temp\yoozj2ta.0.vb
Size 14KB
SHA256 e97e22435834aca159d8f263d4aa7612202bde89e156e5ea631e4970ce519b80
MD5 cca9fb6a7814f07fdbf228d7f564e895
SHA1 f6858d91dc87c20413685ce8ef9db3ac84b871ec
SHA512 d60da3d22f2f6735948beca31a9977793dc8d75103b1b9c895a365e38b9801beaf466bd4f50818737c70a93ca389c1c085bad3b4b71456bec667a7b418af7232
SSDEEP 384:rVNAfUfNnb0uN/NeVlnOvNRuNrcHb+E6NLzN7QZSN7eP:DDnb0CFylWRCrcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

yoozj2ta.cmdline

Path C:\Users\Admin\AppData\Local\Temp\yoozj2ta.cmdline
Size 266B
SHA256 6a1b85eb9e6d3c5fc06218916375cf2170e21864c0ec0427edc55bf5379eccfd
MD5 bad7e8090d7ad1b9d8ea607008c89527
SHA1 49da678b1ca9250bfe9f9805b7d80910179166e4
SHA512 fc1bc82199af738ccd4abd865a29084831ee09fb0149a4c67c3ed7bd698a0e3e2752d76694cc053ee21fae1c7dfad87e00613af2eedbb04b3a25a09dc0d1c1e2
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4836-21-0x0000000075480000-0x0000000075A31000-memory.dmp

Download

memory/4836-1-0x0000000075480000-0x0000000075A31000-memory.dmp

Download

memory/4836-2-0x0000000001500000-0x0000000001510000-memory.dmp

Download

memory/4836-0-0x0000000075480000-0x0000000075A31000-memory.dmp

Download

memory/4928-23-0x0000000000D40000-0x0000000000D50000-memory.dmp

Download

memory/4928-22-0x0000000075480000-0x0000000075A31000-memory.dmp

Download

memory/4928-24-0x0000000075480000-0x0000000075A31000-memory.dmp

Download

memory/4928-26-0x0000000000D40000-0x0000000000D50000-memory.dmp

Download

memory/4928-27-0x0000000075480000-0x0000000075A31000-memory.dmp

Download

memory/4928-28-0x0000000000D40000-0x0000000000D50000-memory.dmp

Download

memory/4928-29-0x0000000000D40000-0x0000000000D50000-memory.dmp

Download

memory/5076-8-0x0000000002280000-0x0000000002290000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads