metamorpherrat | db2064e7716bf71a512887edbdc4e845a59f3269eedd888886a1242bbccc8e17

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe
Size 78KB
Sample240510-gr96kaad59
SHA256 db2064e7716bf71a512887edbdc4e845a59f3269eedd888886a1242bbccc8e17
MD5 88307454306b345ecab1c0ab31b3f0d0
SHA1 608a79037d750c4af2b4397e0b765d2f4e56fdfc
SHA512 b2383040a7c4115cd1870d75042abe5aa29446eca5074a1027fcbef75c30c469cf3dcdf454c30bd8cb2fdc3a283700abee3b33aa66128a4e6e972bc7623c43b3
SSDEEP 1536:yPCHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtX9/n1M9:yPCHY53Ln7N041QqhgX9/2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
652	tmp4FF5.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp4FF5.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	652	tmp4FF5.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 964	320	88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe	84
PID 320 wrote to memory of 964	320	88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe	84
PID 320 wrote to memory of 964	320	88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe	84
PID 964 wrote to memory of 4332	964	vbc.exe	86
PID 964 wrote to memory of 4332	964	vbc.exe	86
PID 964 wrote to memory of 4332	964	vbc.exe	86
PID 320 wrote to memory of 652	320	88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe	88
PID 320 wrote to memory of 652	320	88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe	88
PID 320 wrote to memory of 652	320	88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rjm2cwzv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51BA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC5AD5F65FAAB437DB779CFB68FA0BC2B.TMP"
    3⤵
    PID:4332
- C:\Users\Admin\AppData\Local\Temp\tmp4FF5.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4FF5.tmp.exe" C:\Users\Admin\AppData\Local\Temp\88307454306b345ecab1c0ab31b3f0d0_NeikiAnalytics.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES51BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES51BA.tmp
Size 1KB
SHA256 fb0e3d5f6a41cda6bf2adf10abbb35a80e2d78933ca91c56d725c13c10c7d2bf
MD5 48e0e987a371b1bd17a98f5a337add61
SHA1 373a748c4495dc71ebbf63a56581df50824d42eb
SHA512 b2efeca298602d37316f4c92e60328c56a2cd53444b6d3441cd5fdba6a9440727b3ac4ada5b3753a683d0dfeb61a09ddc81eb035fd33a5b98294bcfbd078c6eb
MD5 SHA1 SHA512

Submit Download

rjm2cwzv.0.vb

Path C:\Users\Admin\AppData\Local\Temp\rjm2cwzv.0.vb
Size 15KB
SHA256 ea5e7e58107a2ad52c1bee24ba56213418f1b4bcc5787b6453d25653a6708c6c
MD5 979ab27e571fa1db2a17ef4e3cc334a4
SHA1 c752b2926d34716d0bcc2b3c7beb259b482e1fbe
SHA512 bb61d516a839601a0b2418b27604ce1e793936baeee0c7e9505444d33690edf7104196cbe2199f625de82670128896e8f796d9da7fe7a552a842b79636150035
SSDEEP 384:rg5Nmj8xNvNFPNDcoNmNEcHb6E6NwXzN7QZSN7eP:MTmj8LVF1/6EcHKwXh0+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

rjm2cwzv.cmdline

Path C:\Users\Admin\AppData\Local\Temp\rjm2cwzv.cmdline
Size 266B
SHA256 a12f39528ac098cf865728179afe712f3b2934e1b9f7eea322790a62ee35b2f3
MD5 8f0bfe7c34e883fb456c8793c730baee
SHA1 856388e359263798c8a6ab145d5267cfd61dea1b
SHA512 79dd90beb0c4bec54452f1235d2a49fdc17935c8dd25086870ede7a3e10e99b80c07805d40c87917bbd46fc0361df607c7b6e3f8bc71d172fd27be2b6cda4112
MD5 SHA1 SHA512

Submit Download

tmp4FF5.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4FF5.tmp.exe
Size 78KB
SHA256 e58342ed2282ed7d32a404f88216d05c0d0d78133dc1748983dcc826595648cf
MD5 95fd272da97b53e6195ed0a4cfb0baf9
SHA1 49333cfe6308c4ff47db7c18ccc713ec2debb78f
SHA512 9bb24184b1c7bbb94e07d51baa95140e3457c21854eb8afba303cd4a9374f4f881eb51396195eae805b2c5cf8bdbd7443d7223a91b99b5504ac056bf53cd323f
SSDEEP 1536:Ny5jYdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt9629/f1cQ:Ny5jnn7N041QqhgN9/T
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcC5AD5F65FAAB437DB779CFB68FA0BC2B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcC5AD5F65FAAB437DB779CFB68FA0BC2B.TMP
Size 660B
SHA256 2a409a4c8b4b58e336f36355f57b1a262c8d8debf11288e15c04e30caaba457b
MD5 b4382cd5f2cb9dca0981db22ba57516b
SHA1 552d40646e28b10bc4adab44e43c5095e9f99a0d
SHA512 97a00a5f4ae694278f41536008e70a6d73239e2fbe820f41296d14fa75640a137eb50cd71a7c0afbed91c12314c2a0c18f17283f27a03cabdb5c74cfdbe57d98
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/320-22-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

memory/320-2-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

memory/320-1-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

memory/320-0-0x0000000074CB2000-0x0000000074CB3000-memory.dmp

Download

memory/652-23-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

memory/652-24-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

memory/652-26-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

memory/652-27-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

memory/652-28-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

memory/964-9-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

memory/964-18-0x0000000074CB0000-0x0000000075261000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads