metamorpherrat | 0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe
Size 78KB
Sample240420-wyk8caee69
SHA256 0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d
MD5 c6267bb1bc66b26b4cc7acf73404fc64
SHA1 57fa9af197f6415167a7570d4534f2131e295bfa
SHA512 d3ba6c736946d588d55b5b07e7e245e3dca4f90c667fead442eb8444610a0aae06af9833ccc6d3b67c8de1eae1b551cac9a5a0fc0d055aa78a0feb4103914b8b
SSDEEP 1536:r4V5mdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96Y9/y/10v:r4V5Rn7N041QqhgP9/ys
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe

Deletes itself 1 IoCs

pid	Process
3968	tmp3875.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3968	tmp3875.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp3875.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe
Token: SeDebugPrivilege	3968	tmp3875.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 3316	876	0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe	85
PID 876 wrote to memory of 3316	876	0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe	85
PID 876 wrote to memory of 3316	876	0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe	85
PID 3316 wrote to memory of 2044	3316	vbc.exe	87
PID 3316 wrote to memory of 2044	3316	vbc.exe	87
PID 3316 wrote to memory of 2044	3316	vbc.exe	87
PID 876 wrote to memory of 3968	876	0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe	91
PID 876 wrote to memory of 3968	876	0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe	91
PID 876 wrote to memory of 3968	876	0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe	91

C:\Users\Admin\AppData\Local\Temp\0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe
"C:\Users\Admin\AppData\Local\Temp\0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kumcotu6.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES398E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDDF6D40917144943AB669475C1DBF5F3.TMP"
    3⤵
    PID:2044
- C:\Users\Admin\AppData\Local\Temp\tmp3875.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3875.tmp.exe" C:\Users\Admin\AppData\Local\Temp\0631336f00dcef6e1b5e51c7183435f8421eacbf48ddf37e8b7fb74db6918f1d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES398E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES398E.tmp
Size 1KB
SHA256 938b054f0d2fc7f44842b4cf034975228969e12d472121ec6b1172d189ea7de8
MD5 645338e56ab052270db65cfdca67849c
SHA1 37f27e48ce30cc012b5e58a3425e09f9bd9f9e88
SHA512 1ac6baeb5f4d21a02095189a60465ea24aa3ec0ce3b25c20e0523a168c18e7de6281cf99f7570e4b73f7f44a7df41146dcb88e4fde2ab9c7d7f6035c7e0a8752
MD5 SHA1 SHA512

Submit Download

kumcotu6.0.vb

Path C:\Users\Admin\AppData\Local\Temp\kumcotu6.0.vb
Size 14KB
SHA256 e0b54fc9bde57f75b9c819651b2f668d0438d7e09818f8e75161dd557c279013
MD5 d84e8a35480ef438bba91027a8913a46
SHA1 5afe2d13d37aa1a62537c61d7703253baed7f348
SHA512 9e892dc2f251f31d3374658ecf47adf9a1a2f7fa5ee746cd1a1f9f06bde3eccb53aefc158930bb36655e401ea219ca9e7dc2c96f715ca7b26582a5878e01a7e3
SSDEEP 384:rbNiNNAcNpaNTNLVlnZBNZ2NMcHb+E6NLzN7QZSN7eP:XN0A8pGBplZ7ZqMcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

kumcotu6.cmdline

Path C:\Users\Admin\AppData\Local\Temp\kumcotu6.cmdline
Size 266B
SHA256 96257f0de62aae67895e28d4d2d2cdf40566c135a7e08f676a98be53a5211a80
MD5 99541a95c8f0e8a6fa801c4881ab2249
SHA1 f4299db6f79d4c8ada8010a0c9be0212c24b0c7e
SHA512 70f9f521af104fb188b28f8a6af714e32bc1c40eead385ce127b01a3a9fe19ddc1327467e485ae7db0acf8b6db5ebae719f702bc0db3616639002143609fef96
MD5 SHA1 SHA512

Submit Download

tmp3875.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3875.tmp.exe
Size 78KB
SHA256 783d848b7586b0c4412217f2a3a0f9efb75df95aa11cb361780f98bc14e01100
MD5 0d79dd0619cbd63ad74837b352e08a1a
SHA1 a2f1bd7228ebc57d920523c1f28eb8f3f3a4669d
SHA512 a6a9e2dbd024d6d8c0631eadb4ec763f3c6cc2be47e017fe659144d1988a2b4022fd465978268c74579968f0664a21b61258deabeefba1b4446ff49287172788
SSDEEP 1536:Y4tHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN9/Y19v:Y4tHa3Ln7N041QqhgN9/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcDDF6D40917144943AB669475C1DBF5F3.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDDF6D40917144943AB669475C1DBF5F3.TMP
Size 660B
SHA256 7b1f955c19424208344ce74ccdcf353e3ac26b64d7453cb53ad677a78b3bdcaa
MD5 c6f84af81a1f6ba0abbeb3a9f0c9f383
SHA1 6544d87e8fec4c26c4ca89f40679b3cbb57273b0
SHA512 ab09920d9703c7e0ddd5c7f61a947da06017304ffea9d9316baed5d706cf431e7ff2c1a92b254e939fcaf2b755997cca7005e4aa4ed7372ca598caa13a74116b
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/876-21-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/876-1-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/876-2-0x0000000001D20000-0x0000000001D30000-memory.dmp

Download

memory/876-0-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/3316-8-0x00000000021E0000-0x00000000021F0000-memory.dmp

Download

memory/3968-22-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/3968-23-0x0000000001360000-0x0000000001370000-memory.dmp

Download

memory/3968-24-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/3968-26-0x0000000001360000-0x0000000001370000-memory.dmp

Download

memory/3968-27-0x0000000074640000-0x0000000074BF1000-memory.dmp

Download

memory/3968-28-0x0000000001360000-0x0000000001370000-memory.dmp

Download

memory/3968-29-0x0000000001360000-0x0000000001370000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads