metamorpherrat | e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2024, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe
Size 78KB
Sample240413-c639caae97
SHA256 e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170
MD5 ca28ac58ffba85a4462f2f36fea1a15b
SHA1 59e6cd157de52eeb7c6ae3444c38c29b40e73756
SHA512 2545c2699c17723cd9f872765152e3ff488d58f2840ff3c687b51c1e96087c6ee973714cf3b3a7e3052c5dc1d07c38c4420062a7292ad8e584d3c6649a88de12
SSDEEP 1536:kHFo6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtRH9/11i0:kHFo53Ln7N041QqhgRH9//
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe

Deletes itself 1 IoCs

pid	Process
436	tmp2EFF.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
436	tmp2EFF.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp2EFF.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe
Token: SeDebugPrivilege	436	tmp2EFF.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4640	4552	e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe	84
PID 4552 wrote to memory of 4640	4552	e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe	84
PID 4552 wrote to memory of 4640	4552	e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe	84
PID 4640 wrote to memory of 3492	4640	vbc.exe	88
PID 4640 wrote to memory of 3492	4640	vbc.exe	88
PID 4640 wrote to memory of 3492	4640	vbc.exe	88
PID 4552 wrote to memory of 436	4552	e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe	90
PID 4552 wrote to memory of 436	4552	e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe	90
PID 4552 wrote to memory of 436	4552	e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe	90

C:\Users\Admin\AppData\Local\Temp\e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe
"C:\Users\Admin\AppData\Local\Temp\e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dz5menyi.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3018.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcABF7AAA3CC3543FBA5A466865B6F1F4A.TMP"
    3⤵
    PID:3492
- C:\Users\Admin\AppData\Local\Temp\tmp2EFF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp2EFF.tmp.exe" C:\Users\Admin\AppData\Local\Temp\e88fa0aea0857534fd66a9fbd4e57744ba385a16a4c934dcada46fa95710f170.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3018.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3018.tmp
Size 1KB
SHA256 196bb38911db754f19940700ecf1f663db07f4863af38f8f8d4df9b9ab7c7f8c
MD5 3a58363590f1ed6997fb1b559ef89585
SHA1 a00dc5d14ba56e4faf13d129ad5321da2a5c030d
SHA512 d5747da6c3b4553048583578c12d07c7910bfb46b83126fb7857ccdd35358d7802c072b487af05cf6244c596bb3b4798e5bcc65b89d9723af6dfbc368ce7739f
MD5 SHA1 SHA512

Submit Download

dz5menyi.0.vb

Path C:\Users\Admin\AppData\Local\Temp\dz5menyi.0.vb
Size 15KB
SHA256 de069868b58b86b4ad4d67426dc59d246811259622a8fe01c1bc3e2697b7d3b1
MD5 7934673d035484340ca81696cfa57647
SHA1 ca7b5ed4e759dbb086cbe7c10f81f32edaad8a07
SHA512 5eede97123cf47676600e40bc68f07cf39ae96180db8bf313f26eea086b81b6b2674274ff88e9b9a77892e3de9411a31252e5cff8480c5a566a687fcebd7528f
SSDEEP 384:rlN3DNcNGgNueiC/y3NVNwcHboE6NGGzN7QKSN7eP:7h8GI1iC/snwcHQGGhL+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

dz5menyi.cmdline

Path C:\Users\Admin\AppData\Local\Temp\dz5menyi.cmdline
Size 266B
SHA256 91c495973c695629dc6f7dfe4bb138f4e40d066a868dde8adf3c5a3c86e088ab
MD5 9756e264efd43ce2b94e4fd1dc7ff015
SHA1 34bcd0ec4e2527c9052715001039e4d37a0975ca
SHA512 80d1ca7764f67f3c4d92a28db3df3be1d722a37e7ea5848feff43786f0072abc0f7b0aef7ec934b5e574ceaa330716b59cc7ce9ef7e0f4d1e2242a0165274df7
MD5 SHA1 SHA512

Submit Download

tmp2EFF.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp2EFF.tmp.exe
Size 78KB
SHA256 f06c46c2b2ea5054e0ebe570c8f8468851aea04b86634eb63d625e8468547a3c
MD5 930cece0e317f3f4f8433c5d69a5f722
SHA1 722f82efb9c670eaa3030583a13e298a3ccd9d2f
SHA512 f4e4a8e2a573ce7625ab422f2d0d399b25e42f276ec9a8ee05aa683ca9d8ab223b2e49b12e1633fb99700b95399aa288c2913a93a368a04be44f292da1a21e0b
SSDEEP 1536:V4V5jS9dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6gp9/C1nA:V4V5jSon7N041Qqhg4p9//
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcABF7AAA3CC3543FBA5A466865B6F1F4A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcABF7AAA3CC3543FBA5A466865B6F1F4A.TMP
Size 660B
SHA256 166e7db694484963f34502f98f8fcc8a0cf72fde0fb062a30db4a0966ed93e33
MD5 35282fe5b23a47c9a08cf4bc5b66f017
SHA1 bdd29ac07a504731af977dda3cd50f26568735df
SHA512 edfa88d3e88e32901a8f5e6cc737435b4445a32fcfc1fea50c812f26eacda9fa97b4a3ea2be0afbcdbc66eb538c2777f21e20356ee7b8ad58b2cc34a9b7d2c9e
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-23-0x0000000001490000-0x00000000014A0000-memory.dmp

Download

memory/436-22-0x00000000753B0000-0x0000000075961000-memory.dmp

Download

memory/436-24-0x00000000753B0000-0x0000000075961000-memory.dmp

Download

memory/436-26-0x0000000001490000-0x00000000014A0000-memory.dmp

Download

memory/436-27-0x00000000753B0000-0x0000000075961000-memory.dmp

Download

memory/436-28-0x0000000001490000-0x00000000014A0000-memory.dmp

Download

memory/436-29-0x0000000001490000-0x00000000014A0000-memory.dmp

Download

memory/4552-2-0x0000000000B50000-0x0000000000B60000-memory.dmp

Download

memory/4552-1-0x00000000753B0000-0x0000000075961000-memory.dmp

Download

memory/4552-21-0x00000000753B0000-0x0000000075961000-memory.dmp

Download

memory/4552-0-0x00000000753B0000-0x0000000075961000-memory.dmp

Download

memory/4640-8-0x00000000024F0000-0x0000000002500000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads