metamorpherrat | e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2024, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe
Size 78KB
Sample240414-c7myrade44
SHA256 e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7
MD5 6940426c9de0ce428b390fa5945206e6
SHA1 54669f5cef15da22c0e91beef1d6650f20335244
SHA512 744fd90e828518f0a0f0926fc0f0447a91ae962fdcf3970c45a035c8e802528eebf6fb73cf99d8f36c28a204fe88b9ca6185c2c09659837c2b7918c96664d9a9
SSDEEP 1536:gtHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt99/2n1w1:gtHFq3Ln7N041Qqhg99/x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe

Executes dropped EXE 1 IoCs

pid	Process
3832	tmp5C1A.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp5C1A.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe
Token: SeDebugPrivilege	3832	tmp5C1A.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 640	840	e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe	88
PID 840 wrote to memory of 640	840	e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe	88
PID 840 wrote to memory of 640	840	e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe	88
PID 640 wrote to memory of 2304	640	vbc.exe	90
PID 640 wrote to memory of 2304	640	vbc.exe	90
PID 640 wrote to memory of 2304	640	vbc.exe	90
PID 840 wrote to memory of 3832	840	e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe	91
PID 840 wrote to memory of 3832	840	e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe	91
PID 840 wrote to memory of 3832	840	e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe	91

C:\Users\Admin\AppData\Local\Temp\e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe
"C:\Users\Admin\AppData\Local\Temp\e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j6xmf67r.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D72.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7C94055EE0A4470DBFA2FB28F3F654DD.TMP"
    3⤵
    PID:2304
- C:\Users\Admin\AppData\Local\Temp\tmp5C1A.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5C1A.tmp.exe" C:\Users\Admin\AppData\Local\Temp\e6ba270dc6dbea6bcafb26b8562778a983f18dad72cf4bc33ad00dfd40479ae7.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5D72.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5D72.tmp
Size 1KB
SHA256 33612057fdd1b55d3b01d8cff3f3379a60cec397ff07e2abd774f92476536b4b
MD5 582345c0eba83ff1535de51d60088deb
SHA1 df66fc0e9c78b2237ead04c5976324bafdcf756b
SHA512 eb17cb64218e8f9f81c2c2caee9498d2b9da90e818b4afbeba389af632edbd8c48a67e29fecb4cd5be266c765c9ca59806fce082c3ed473ee057ff41855bce3f
MD5 SHA1 SHA512

Submit Download

j6xmf67r.0.vb

Path C:\Users\Admin\AppData\Local\Temp\j6xmf67r.0.vb
Size 15KB
SHA256 11020ccf4284acbad4c4c17ef1a80333ab6eead688f7bcc0c014e91588329a0b
MD5 599ba96e22d50291f737bdb043f93b2e
SHA1 9ea3f12ef3a64193a68caf240dd76f3d8e8755a2
SHA512 e5910a7b3e663bb49f1adaf443fa65c411817ae29a992aa8e2e615c964db6cddbd4ea2938a21be518ea44c24b0a1caff2c643a60286e6da24dd2232930b1ac2d
SSDEEP 384:rGUNKnNbZNMNOgK8QqNVBNacHb+pE6NUzN7QNSN7eP:BcbzMZV7acHuUhc+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

j6xmf67r.cmdline

Path C:\Users\Admin\AppData\Local\Temp\j6xmf67r.cmdline
Size 266B
SHA256 de03f6031ea573cf93d3203ed9c32294d9dc9336b0f3967dd3f26140e193ecb7
MD5 e3dc62c6c6b7da55c240c2439e2539f5
SHA1 eace34a8efc70553f3a6d697c7fc64f95cea1838
SHA512 15e1407fe3d546247e94fe3c388247672861f127330839b608216fc8f95940cb33fa587eee2be1bbc09f7881ebf9797ea20c890b2cdfa171fbddfebf103d711f
MD5 SHA1 SHA512

Submit Download

tmp5C1A.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5C1A.tmp.exe
Size 78KB
SHA256 ab8a2cf4964ebd20466712a275c66bf4db42916a827d57e23ab6f3c18e881868
MD5 28e9360d75871492c30da508c6f977c8
SHA1 f217d911fde8d0e9ded5757491ba6ba233d3a3e3
SHA512 0e84972a301c19c71084143c4aeb63e7c70c701b7dfb407556e85b598b46def32ff360e4a0b1a8b6cb75a91e36b2aef9e302c1d9d8f39e820ffb33ce2212a9fe
SSDEEP 1536:lRy5j5dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6d9/s1Mu:lRy5jkn7N041Qqhg19/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc7C94055EE0A4470DBFA2FB28F3F654DD.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc7C94055EE0A4470DBFA2FB28F3F654DD.TMP
Size 660B
SHA256 0b0cbcabc59f125b35894a00142bccf559672b8e0b25188b1ebefedbfcd167e5
MD5 1ed4d49382386fbf59389f8928e8bfa3
SHA1 08011fdf3b243708b0af19c207ad88d310d02073
SHA512 e2e11d864f99d1684ff5afef038f5bdef0cb6784300468f9dad30cd412ad627c0f7100a56d4b2d36b8c9aee69495019ff525148a72ea5845be5a44bfccd9ec44
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/640-8-0x00000000023E0000-0x00000000023F0000-memory.dmp

Download

memory/840-0-0x0000000074E00000-0x00000000753B1000-memory.dmp

Download

memory/840-2-0x0000000074E00000-0x00000000753B1000-memory.dmp

Download

memory/840-1-0x0000000001430000-0x0000000001440000-memory.dmp

Download

memory/840-21-0x0000000074E00000-0x00000000753B1000-memory.dmp

Download

memory/3832-22-0x0000000074E00000-0x00000000753B1000-memory.dmp

Download

memory/3832-23-0x0000000000D00000-0x0000000000D10000-memory.dmp

Download

memory/3832-24-0x0000000074E00000-0x00000000753B1000-memory.dmp

Download

memory/3832-26-0x0000000000D00000-0x0000000000D10000-memory.dmp

Download

memory/3832-27-0x0000000074E00000-0x00000000753B1000-memory.dmp

Download

memory/3832-28-0x0000000000D00000-0x0000000000D10000-memory.dmp

Download

memory/3832-29-0x0000000000D00000-0x0000000000D10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads