metamorpherrat | ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/04/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe
Size 78KB
Sample240413-ebyrgsbb63
SHA256 ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29
MD5 5216ecd19e836fabfc419a09111b8139
SHA1 727d602774897c317608a673ffaf7b01b67d0b53
SHA512 51c7d937bba5293746d213ced892fe50e05325f33639c250bbcc252a03dfaaaf8e7209da0dfd19889f02f964196051cf70f9d35fed90ebb0478ecbfa557b4e0a
SSDEEP 1536:9c58Vdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96T9/l1rx:9c58An7N041QqhgI9/t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2728	tmp8E99.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe
1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp8E99.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe
Token: SeDebugPrivilege	2728	tmp8E99.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2688	1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe	28
PID 1400 wrote to memory of 2688	1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe	28
PID 1400 wrote to memory of 2688	1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe	28
PID 1400 wrote to memory of 2688	1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe	28
PID 2688 wrote to memory of 2460	2688	vbc.exe	30
PID 2688 wrote to memory of 2460	2688	vbc.exe	30
PID 2688 wrote to memory of 2460	2688	vbc.exe	30
PID 2688 wrote to memory of 2460	2688	vbc.exe	30
PID 1400 wrote to memory of 2728	1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe	31
PID 1400 wrote to memory of 2728	1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe	31
PID 1400 wrote to memory of 2728	1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe	31
PID 1400 wrote to memory of 2728	1400	ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe	31

C:\Users\Admin\AppData\Local\Temp\ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe
"C:\Users\Admin\AppData\Local\Temp\ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fz8n6p0m.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES906E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc906D.tmp"
    3⤵
    PID:2460
- C:\Users\Admin\AppData\Local\Temp\tmp8E99.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8E99.tmp.exe" C:\Users\Admin\AppData\Local\Temp\ff8703aab39a8fe5c8f605d904a59dc5f2fd70ee79652c4bab17f65477d6bb29.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES906E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES906E.tmp
Size 1KB
SHA256 0c6a2e3d0102c4020e4f08c0cae8b462acf8e4232591840a04cb2a211ace32e3
MD5 1e8f111a849abd71da78a0c16d9c7cbe
SHA1 b75230b19d6da33e0a9035d27e79610ab44578ec
SHA512 6bf36961a382bcd177e39c7bc4c9ee57ea9299634ae00b733a282be8222411d6ab5977e0f85f394acdb819ac8cd2b818ff4536e581b2bc2e75e0cb8922d5678c
MD5 SHA1 SHA512

Submit Download

fz8n6p0m.0.vb

Path C:\Users\Admin\AppData\Local\Temp\fz8n6p0m.0.vb
Size 14KB
SHA256 858cd9f36d2ecf5093e66b003a0865e3ec341be61137093de03239d4cf5389a7
MD5 fe6239bbbc15fbc31cafa7b171c0d32b
SHA1 cc12d2d1c916edddac3802bcfc8be08870cc7173
SHA512 1487f1298768ad29d75adb1aa1423b50313b5966719e32606cdf26b7055aef1348124bf35056ba132352fabdd99d26ed3ed107e1b035b61a5dc8dede38a037cd
SSDEEP 384:raN6INVjNqEBNyHWVlnpNVeNCcHb+E6NLzN7QZSN7eP:66wVxVblj0CcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

fz8n6p0m.cmdline

Path C:\Users\Admin\AppData\Local\Temp\fz8n6p0m.cmdline
Size 266B
SHA256 9bd52dc71f9f4434ed5ea82c4afb8111dfc11212ed16fc0e326c18c97b992055
MD5 8b7a5b66047b78e01c0ef70943bb3e25
SHA1 165b5fe835ec09623bc9f64a6c576a20a7f59d28
SHA512 a3776098e901438cf4373348a1c0628b08666ba0318f2643b86569f2f68be0e457360d6488472403ec054a47965bd5bcd68c1aad2cc95961e6fc9898d42402e4
MD5 SHA1 SHA512

Submit Download

tmp8E99.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp8E99.tmp.exe
Size 78KB
SHA256 0653e4cd3be6fcdd55e486f06128fdf9dc6cc5688f06d9677781a9b7daae20f7
MD5 7b48e5d9c9f7129f6acbcb9aa354f694
SHA1 95f448c0a3f9a91c6977434463f5d3262d3f6cbb
SHA512 627eaf1a1daf5e2b4896153c697de2fd203cf9c0e11eb8accf752c1c3d02e49ad9b0cb43c7ff0c9787b24d0a9ddc886b25378090681333e2b31422c185cf3a90
SSDEEP 1536:MPCHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt1L9/a16r:MPCHa3Ln7N041Qqhg1L9/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc906D.tmp

Path C:\Users\Admin\AppData\Local\Temp\vbc906D.tmp
Size 660B
SHA256 5cf1979748fbc1d814793d732667dff3b97a8446d2af1dd37be4b707a5f387bf
MD5 801c562d035bdfa15a88a830705ab72f
SHA1 4380d53eab00b763316084e9e4ba06a6572f9a33
SHA512 9ae03e5121a4f2adc9cd3b68f6520074c6c0ac3c8e46ef773cc8a599a33c2d7d768bfe9ffc6748b3b34b49a4803170b51def64b525341cda405380588e3f9c89
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1400-24-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Download

memory/1400-2-0x0000000000170000-0x00000000001B0000-memory.dmp

Download

memory/1400-1-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Download

memory/1400-0-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Download

memory/2688-8-0x00000000002A0000-0x00000000002E0000-memory.dmp

Download

memory/2728-23-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Download

memory/2728-25-0x0000000000C10000-0x0000000000C50000-memory.dmp

Download

memory/2728-26-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Download

memory/2728-28-0x0000000000C10000-0x0000000000C50000-memory.dmp

Download

memory/2728-30-0x0000000000C10000-0x0000000000C50000-memory.dmp

Download

memory/2728-29-0x00000000744D0000-0x0000000074A7B000-memory.dmp

Download

memory/2728-31-0x0000000000C10000-0x0000000000C50000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads