metamorpherrat | 5ea9d3dc5ca703975a7a467896393def90e81aa98334f67a6b7b1c7ced8c2c21

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe
Size 78KB
Sample240415-dsc1nsdb95
SHA256 5ea9d3dc5ca703975a7a467896393def90e81aa98334f67a6b7b1c7ced8c2c21
MD5 f02d4ab7fa2e82d862847cd69e1f9f3d
SHA1 57cfcdf466831c0c49c0021ea2a5d2bd66ed2d25
SHA512 6981930cef727fc654defd081ccdaad014349cc04c87f7f848fbdb4745ccf399e87c2049481693297fb391cb7bad064dcf50fbfbad08a8355df825dc608be0b7
SSDEEP 1536:bPWV5DXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtd689/aK16O:bPWV5zSyRxvHF5vCbxwpI6Wf9/V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3728	tmp5285.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_perf2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mscordbi.exe\""	tmp5285.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe
Token: SeDebugPrivilege	3728	tmp5285.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2428	2732	f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe	86
PID 2732 wrote to memory of 2428	2732	f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe	86
PID 2732 wrote to memory of 2428	2732	f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe	86
PID 2428 wrote to memory of 3204	2428	vbc.exe	89
PID 2428 wrote to memory of 3204	2428	vbc.exe	89
PID 2428 wrote to memory of 3204	2428	vbc.exe	89
PID 2732 wrote to memory of 3728	2732	f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe	92
PID 2732 wrote to memory of 3728	2732	f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe	92
PID 2732 wrote to memory of 3728	2732	f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe	92

C:\Users\Admin\AppData\Local\Temp\f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sqsrccnr.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53DD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF681D0E4480D44868EFB1FBADC0DC2D.TMP"
    3⤵
    PID:3204
- C:\Users\Admin\AppData\Local\Temp\tmp5285.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5285.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f02d4ab7fa2e82d862847cd69e1f9f3d_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES53DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES53DD.tmp
Size 1KB
SHA256 a7a912fe4fb47e2e4eca512f7e8488cca1a89892cf2d0b1b7fa1d28562bbba4a
MD5 e166bc938336ab9e42f396063c5e6a3c
SHA1 8d846e61c4c3089423a7ca7a3997badc12ce527b
SHA512 c9c9cf4f745edbbb34010872cc05ccd8adb2dd808415b3ef634e64e83855ad2c9d18f5e0333f7a01732c9a459c41a576b7667af5b6989a6c5899791eecd9933a
MD5 SHA1 SHA512

Submit Download

sqsrccnr.0.vb

Path C:\Users\Admin\AppData\Local\Temp\sqsrccnr.0.vb
Size 14KB
SHA256 51c2131bcdf5da54cd7bd939130994dfa4320f704ea41699f6113a5ff8cc6855
MD5 3c8ae6bf67c047fe37d6f5b7b0b8e1ce
SHA1 83e7cddba0d43fa4affd0527b4fa431eab54b816
SHA512 bedf40fd7c31b5f42624072a649322ea83c5b91f73d0b2465b871b61011755293ae2ac67052d36760f8a1610461e9b057b2b8abf7db55747be5aacc0201a6cbb
SSDEEP 384:r5XN0NMNCN63VkghNDNTcHbzE6NnzN7Q7SN7eP:Vd0MOpIRTcHrnhs+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqsrccnr.cmdline

Path C:\Users\Admin\AppData\Local\Temp\sqsrccnr.cmdline
Size 266B
SHA256 0abc978ee0d2683ab161a2d05902f7ae000ad20d1ae97954596888a3b121caa6
MD5 2d6e831bbd23f917e4964623b9624bcf
SHA1 57091204243106e501ca88f45fa36a9f2ae43cc5
SHA512 157b84a684bb1ed64ef4648e29cd7a86646146bc13a682b7b62e6d619d4f6da977bf878d343422a89ba198fa3b18e8d7d735bc44a44a234cd21b18ad2539abe6
MD5 SHA1 SHA512

Submit Download

tmp5285.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5285.tmp.exe
Size 78KB
SHA256 942c8343426cce35be9adcb3ed4122782347bc96dda1647eb0af03e76f751209
MD5 cbf051102665b7c4cb1b22eb3676ec26
SHA1 0ac7dac82542aa8a6abf907b80c90696a240c44f
SHA512 290ff1f54a647958774d722aecb8ea45c913a0a6a68356e70aea76d46feb1249476b4070e5af0c86a0b7f82d18a011cabb9f66b8aca948a4fd02f4cfde5d959c
SSDEEP 1536:OuHY6JIdXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQt+u9/q+iB1FW:OuHYOINSyRxvHF5vCbxwpI6W+u9/q+X
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcF681D0E4480D44868EFB1FBADC0DC2D.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcF681D0E4480D44868EFB1FBADC0DC2D.TMP
Size 660B
SHA256 d70f6e46f2291604c7b27e8f6be10e469b7b7e76c73d288ae3611ff1b531de74
MD5 65a8a7ff5b610da8c7fd5985e15b9639
SHA1 6c8d555fb76f945a49dbd4b0d368dee5f434646f
SHA512 c465b5ed71ca95c0a1c73a948124f661e2e5eadc986eb7e11eb7982f8935008735aa8c589f501e67bbe222f7527c87c5a2330db111d308081569903ca0c20517
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e2eb52524ddfed5e52a54484b3fecdc9ebe24fb141d1445d37c99c0ab615df4f
MD5 097dd7d3902f824a3960ad33401b539f
SHA1 4e5c80de6a0886a8b02592a0c980b2bc2d9a4a8f
SHA512 bb77c3f7b9b8c461b149f540a0dab99fdde474484b046d663228d8c0f1b6a20b72892643935069dd74134c8ab8e8f26b6badc210a6929a737541b9861007fbe4
SSDEEP 1536:0XT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtQ:sSyRxvHF5vCbxwpI6WQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2732-2-0x0000000001420000-0x0000000001430000-memory.dmp

Download

memory/2732-1-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/2732-0-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/2732-20-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/3728-21-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/3728-22-0x0000000000DD0000-0x0000000000DE0000-memory.dmp

Download

memory/3728-23-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/3728-25-0x0000000000DD0000-0x0000000000DE0000-memory.dmp

Download

memory/3728-26-0x0000000074EE0000-0x0000000075491000-memory.dmp

Download

memory/3728-27-0x0000000000DD0000-0x0000000000DE0000-memory.dmp

Download

memory/3728-28-0x0000000000DD0000-0x0000000000DE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads