metamorpherrat | 835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2024, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe
Size 78KB
Sample240413-2tkznsba23
SHA256 835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330
MD5 8cd484a1465f5ed97b7de2fa3017d0f6
SHA1 777ba0e01047913bfc7f11404d3f939787ed938f
SHA512 55a06ef11c37528a6b03d61724239314550f6fd3ffb6ec5a2a920ab96569b66e52feda22c51f29c08031a1a197f87b68aa423ae2a74636884fd6dad57183719d
SSDEEP 1536:qV5jidy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6u9/I1do:qV5j9n7N041Qqhgm9/b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation	835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe

Deletes itself 1 IoCs

pid	Process
2036	tmp84DF.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2036	tmp84DF.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp84DF.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe
Token: SeDebugPrivilege	2036	tmp84DF.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3452	2924	835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe	85
PID 2924 wrote to memory of 3452	2924	835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe	85
PID 2924 wrote to memory of 3452	2924	835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe	85
PID 3452 wrote to memory of 4296	3452	vbc.exe	87
PID 3452 wrote to memory of 4296	3452	vbc.exe	87
PID 3452 wrote to memory of 4296	3452	vbc.exe	87
PID 2924 wrote to memory of 2036	2924	835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe	88
PID 2924 wrote to memory of 2036	2924	835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe	88
PID 2924 wrote to memory of 2036	2924	835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe	88

C:\Users\Admin\AppData\Local\Temp\835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe
"C:\Users\Admin\AppData\Local\Temp\835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9zg3pezw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES878F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8A5F21519E444CD087C9EB5DA3E94D2F.TMP"
    3⤵
    PID:4296
- C:\Users\Admin\AppData\Local\Temp\tmp84DF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp84DF.tmp.exe" C:\Users\Admin\AppData\Local\Temp\835807039292ffb28261023bca978f66599958425fb87818baa7c9e5b3db4330.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9zg3pezw.0.vb

Path C:\Users\Admin\AppData\Local\Temp\9zg3pezw.0.vb
Size 14KB
SHA256 35f4bbb44474e7130d8ce5951b091caf5684af821a87fff5d7c6075b04826ddc
MD5 37cfa588db88dc67f04e9b610a318294
SHA1 ad703e5e07959ba0cdabdda4dcb093986a749eb3
SHA512 4c4d4574735e8394f0026e0d557df5a59a649abed7d856cd4bbe9207b6f74655ddd2c6e60527a0d0b65662b098616418e194c16c4454abe16e2af958c06802e5
SSDEEP 384:rz6Nk7sNZnANjNjVlnSyNGNRcHb+E6NLzN7QZSN7eP:3mkwZnoxxl3aRcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

9zg3pezw.cmdline

Path C:\Users\Admin\AppData\Local\Temp\9zg3pezw.cmdline
Size 266B
SHA256 211346fb9c1c5c388a8262e17fa37e72daa3ee4599a2caf34e17503f1d96d416
MD5 ad28b1e5bc13fdb5a1f8d3c0a7351164
SHA1 af790071695532442c61040198478eabde5f4295
SHA512 7a3831d294a1072956d9a1e155e81513136617e15b469343e846abbf1e9d8c943e1f5f3020363441dc874167d3f69744262c4655313a0291cf4bd91775bd378b
MD5 SHA1 SHA512

Submit Download

RES878F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES878F.tmp
Size 1KB
SHA256 52678c629be1254d3e21558f686ec7d7dd389ce29edd39cab54697b7e56168ce
MD5 8146cfb3e3f5ca25005f5da0d89240d7
SHA1 62b89630907561bc7bec24bf544826f474e71ee8
SHA512 0fa4babb1b44548bd8713d8f7ab1393315d4ff797aaa7eccac0a9471b160b9d68e4cb89bc09cd7775912bbeafc7864728b25ccf9d2bef1a7728538ef5ffff201
MD5 SHA1 SHA512

Submit Download

tmp84DF.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp84DF.tmp.exe
Size 78KB
SHA256 032f96a3a6d24aef873c1857748c86cd5a1c475501a06867b05be19734a6eacc
MD5 d6eb6c2f118d2b5ea8e671ebba985a36
SHA1 ed78be91e13e2edc9ea46d311c5fa4ec88891b8d
SHA512 9347d4c7c26cef9054c75c264450105dd76ea26eafdccbf1ee3d11ef46f9345397fffa1059a57ffe390cbdbeea10454a3541778dd825b8ef9ec3951acd023d53
SSDEEP 1536:EsHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtb9/KN1gu:EsHFq3Ln7N041Qqhgb9/K3
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc8A5F21519E444CD087C9EB5DA3E94D2F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc8A5F21519E444CD087C9EB5DA3E94D2F.TMP
Size 660B
SHA256 cc29d0887b6894057b1f63a45caecb46bbf3a12b9d78ce5cbd2aece32d4cd444
MD5 b94b8d58c3f51de04e77b683b67ac039
SHA1 027cb73d63c718c1335261b01dec1b6e0092030a
SHA512 a7c477d81028f43b36d76f8df0d2d7edee5d26b35f44365a859d7e38ad2aad69d51e89ba9f98ca1530b6f06bfb57f345445c6af328e0e9e580941351c5e79767
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2036-23-0x0000000000F40000-0x0000000000F50000-memory.dmp

Download

memory/2036-22-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/2036-24-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/2036-26-0x0000000000F40000-0x0000000000F50000-memory.dmp

Download

memory/2036-27-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/2036-28-0x0000000000F40000-0x0000000000F50000-memory.dmp

Download

memory/2036-29-0x0000000000F40000-0x0000000000F50000-memory.dmp

Download

memory/2924-2-0x00000000016B0000-0x00000000016C0000-memory.dmp

Download

memory/2924-1-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/2924-21-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/2924-0-0x0000000074E60000-0x0000000075411000-memory.dmp

Download

memory/3452-8-0x0000000002580000-0x0000000002590000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads