metamorpherrat | 65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe
Size 78KB
Sample240424-vd57cade27
SHA256 65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684
MD5 60b43e7f90c72c53a9acd3ec5da93d58
SHA1 3dc66d0ca2087dcd07975b204d4ae5419ac356e7
SHA512 e2308c7c83e83631c7111930a60dc254261140b27fb83680b46bdef3fbe2287a340aeca3cf0b04e374004072157baa60c84865949fee7c32a723679cc3c3ccbd
SSDEEP 1536:RPWV5jS6dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6JP9/d1GE:RPWV5jS1n7N041QqhgB9/3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe

Executes dropped EXE 1 IoCs

pid	Process
4572	tmp378B.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp378B.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe
Token: SeDebugPrivilege	4572	tmp378B.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2804	1532	65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe	84
PID 1532 wrote to memory of 2804	1532	65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe	84
PID 1532 wrote to memory of 2804	1532	65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe	84
PID 2804 wrote to memory of 4784	2804	vbc.exe	86
PID 2804 wrote to memory of 4784	2804	vbc.exe	86
PID 2804 wrote to memory of 4784	2804	vbc.exe	86
PID 1532 wrote to memory of 4572	1532	65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe	88
PID 1532 wrote to memory of 4572	1532	65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe	88
PID 1532 wrote to memory of 4572	1532	65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe	88

C:\Users\Admin\AppData\Local\Temp\65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe
"C:\Users\Admin\AppData\Local\Temp\65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jj2pqdua.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3865.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc22EEFB22CBF94EE1A7C38F0F11DE1FC.TMP"
    3⤵
    PID:4784
- C:\Users\Admin\AppData\Local\Temp\tmp378B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp378B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\65fb62cbc419f36f5649b5cf90fd5de5377db27904d5f85aa828dc3326bf1684.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3865.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3865.tmp
Size 1KB
SHA256 c93b37614c20277625cb44dc6aa6fafb25174ea8ad8b1e956bb2c09d4e2f37b1
MD5 7f692e28789a0560e7f7493dc7c1b573
SHA1 d6922fbdc283e80ac12dbf0ee4d860bfa08746a6
SHA512 cfeb25b9fd03f8e1ecb2344ed4e11623b0f555ccc43c7a2c3dee5b14a54124e408a8cc3f4af6b6f66f911e179e38e0c1059b7776b09f5a56aae201a53f6c6a41
MD5 SHA1 SHA512

Submit Download

jj2pqdua.0.vb

Path C:\Users\Admin\AppData\Local\Temp\jj2pqdua.0.vb
Size 14KB
SHA256 ba12b1b04707fb6d6e170545b3f501e1b93c06e5e48fe0820dcee0799d80dde5
MD5 2bca4c717d40e83bde2e5c9311794f27
SHA1 5f948a36119c69e29d8543952ad7e526098e2996
SHA512 44d57a514bd65ec74ca0be5767900b0e8de09897912f0217f026e641c329bbee3416bf3741bb52ca7af1d22dc5e1a4cbfbdfa108b137b0cc229b6e4ff71f9b94
SSDEEP 384:rZn3kN2Sl6pNtVlVNq5NyVlnNNfNWcHb+E6NLzN7QZSN7eP:dn05l2tVl8mlflWcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

jj2pqdua.cmdline

Path C:\Users\Admin\AppData\Local\Temp\jj2pqdua.cmdline
Size 266B
SHA256 ae8112c0837d41993af0a162981ee7e4a8b894917c5a8f771571b2389d5ba109
MD5 1046b3c17c1318ce491f3c9588bf393d
SHA1 5a53c81004cbde9f58efe4e622a2ce9c476f3c2d
SHA512 eb8f7d65b3f13c3d51a0d49d87806a9e460f13f8966c271f3973bac1ed6ad075d2681d1ba428f02d99f482d75b05da7536e2e4c4e0dcbe4df961f0cac597b26d
MD5 SHA1 SHA512

Submit Download

tmp378B.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp378B.tmp.exe
Size 78KB
SHA256 20608a4d9313daa6c6e49cc6e1c8bd986fe08143e6132fd603c0e7cf4e8eb35a
MD5 deb6c519ae5a2ff14ae79d84d05322de
SHA1 6aecaa11fb1a176767aad4541b289143430fa909
SHA512 81821d6758b75026d63c5dfbf88a46aef665dbae532ae40f9dc6f5ad9e47dc85bcb0e7253ac82ee8c11be8a8ddd52c9c415a501c44399d1510080c09efd17ce4
SSDEEP 1536:9HH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtF9/Z1E2:9Ha3Ln7N041QqhgF9/n
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc22EEFB22CBF94EE1A7C38F0F11DE1FC.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc22EEFB22CBF94EE1A7C38F0F11DE1FC.TMP
Size 660B
SHA256 ad1bf5af79e56bd0d5e300e77a8567eb974b654c304aa4776ec5fa24e50f4ae2
MD5 b3619dc20f32083c61619e6c6589f5b3
SHA1 edbfc72cf09a4b79b145aa2de75abd72cbb04171
SHA512 36a8e7afb7a619a08613f9bda3a98ba219a6dd5dc7518d9c8ff6b3627427024ddc552a3d1d67c3b39aff06c5ed995c52521b8d152093baa0822dd8aaaeb9463f
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1532-21-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/1532-1-0x00000000015F0000-0x0000000001600000-memory.dmp

Download

memory/1532-2-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/1532-0-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/2804-8-0x0000000002370000-0x0000000002380000-memory.dmp

Download

memory/4572-22-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/4572-23-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/4572-25-0x00000000011E0000-0x00000000011F0000-memory.dmp

Download

memory/4572-26-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/4572-27-0x00000000011E0000-0x00000000011F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads