metamorpherrat | d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe
Size 78KB
Sample240425-efvkmafa3v
SHA256 d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a
MD5 b782ea7d13da3568280bd96b0d11f13d
SHA1 b43f700a1216a792e377be6bbfd4c65e73349bc0
SHA512 0fb561a79a092ceac29e0a89139c4b1d850c189574444d9242913495baa788e9491fd6f6ea46221c4d5dec80c0b9923968c9a50340782be99177a7635553fb9e
SSDEEP 1536:Hc5mdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96J9/m1s6:Hc5Rn7N041Qqhgi9/E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe

Executes dropped EXE 1 IoCs

pid	Process
3928	tmp376B.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp376B.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe
Token: SeDebugPrivilege	3928	tmp376B.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1840	4376	d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe	84
PID 4376 wrote to memory of 1840	4376	d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe	84
PID 4376 wrote to memory of 1840	4376	d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe	84
PID 1840 wrote to memory of 3484	1840	vbc.exe	87
PID 1840 wrote to memory of 3484	1840	vbc.exe	87
PID 1840 wrote to memory of 3484	1840	vbc.exe	87
PID 4376 wrote to memory of 3928	4376	d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe	90
PID 4376 wrote to memory of 3928	4376	d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe	90
PID 4376 wrote to memory of 3928	4376	d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe	90

C:\Users\Admin\AppData\Local\Temp\d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe
"C:\Users\Admin\AppData\Local\Temp\d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s2ytex8h.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3817.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc35437EBEB54348DE827E2BAD45A7AFD8.TMP"
    3⤵
    PID:3484
- C:\Users\Admin\AppData\Local\Temp\tmp376B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp376B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\d66ef0f0eadf761db32fd747c7d25ceafad8b8f44e48c225cb61d72874a0882a.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3817.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3817.tmp
Size 1KB
SHA256 5aa046f775a1398c01554d02cc96384ceff02a35290fc21b133021345bd92ddb
MD5 972e05b1fbb997a495bf6d0589804b02
SHA1 f4a32cab64f25ed518e170d2900f6f1d32bc7490
SHA512 91959c11e79edb2ed5b0c63dcfa4f513730a9868f154a8acb6f935a2e8b03e9ad3c3833a8f9b81ba20321300283cf4ca524c190d8fba4c3409ee13ec6054cc8c
MD5 SHA1 SHA512

Submit Download

s2ytex8h.0.vb

Path C:\Users\Admin\AppData\Local\Temp\s2ytex8h.0.vb
Size 14KB
SHA256 246bacaf815f48f8eb306bb0d21669d8d6a8ce00ba1006ee8e314589a427bb06
MD5 5bf4b00b432f9901b3c316286c4c94cb
SHA1 b6371f6642717268386dabcc9f26696f20f0fd6d
SHA512 ab1a39965ab1346b4f7df54a08e24df9c17555125a4a6c5768805d2119430ee31b87c9c1653aefb9b6432a47365c58f4f5aa44ffdd34b497a46b2d4e818a5ec2
SSDEEP 384:rmNLdNZiNPNfVlnuNulzNHcHb+E6NLzN7QZSN7eP:2LPZu1dlCGHcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

s2ytex8h.cmdline

Path C:\Users\Admin\AppData\Local\Temp\s2ytex8h.cmdline
Size 266B
SHA256 379e21caa1af845ca73bdc8e25385251a9c6bae069e9e15ba4d3ea2e79a3b90d
MD5 58bfd9580ebe935e3e7e957bf879f21e
SHA1 472b7932b8d2de0d0088cb2df63f1715d0dd1b63
SHA512 761a23a7a030f0ca5f75677e212c48825d23fe49112944003012319c765d60323f9c23b81d540475d7d78964a8a829747d2275821afefb653306a43141c54da5
MD5 SHA1 SHA512

Submit Download

tmp376B.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp376B.tmp.exe
Size 78KB
SHA256 e15b2f8e3a7f13865225b36cb3dda2b3bfcf5cb346c082355621cfa2dfd0f075
MD5 e1831d7a3606897c5ccdeb16d7596d56
SHA1 846df9186ccf34f8ae276f8efba948edb1c6f3ca
SHA512 46c5bbb0d631d70c7c0ee720fbf0b24a43e2e1686d5d8059863e36099950d6e24dd5626162baceab4002b3a9210c2bec81956553a49164c6f34104573a96a35b
SSDEEP 1536:WPWtHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQte9/G12k:WPWtHY53Ln7N041Qqhge9/0
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc35437EBEB54348DE827E2BAD45A7AFD8.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc35437EBEB54348DE827E2BAD45A7AFD8.TMP
Size 660B
SHA256 9e38d81c0738d2aa4f696393a8b4843b799b7a5d0d089ddafb60142aa6b32486
MD5 2a9fc73131367c7bf35e14abf6c591e8
SHA1 0b60ac92c2947db72218143059b0e09be676441a
SHA512 18d7e807ae4e9a8e489e5644c406b455fcff3af3aacafdafa93ac3236d45346690725d9b421c268dbd04d01096cf502bb14c25087f0fbe5778821bce4ed385b0
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3928-25-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/3928-21-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/3928-22-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/3928-23-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/3928-26-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/3928-27-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/3928-28-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/4376-1-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/4376-0-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/4376-20-0x0000000074650000-0x0000000074C01000-memory.dmp

Download

memory/4376-2-0x0000000001BF0000-0x0000000001C00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads