metamorpherrat | 71706ce7124cf84729c47145846daaa8d3c732e204327ee8518730bcdf175fb2

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe
Size 78KB
Sample240518-yca7csbh91
SHA256 71706ce7124cf84729c47145846daaa8d3c732e204327ee8518730bcdf175fb2
MD5 3a67d5a900ea6f8e14d6ea964453b7a0
SHA1 4a588558c2bf3c6a743432b06a6381de21149911
SHA512 8ad9748efba818ecc2b9b191f354fa4dd4e06cbbbceeee6ea59480098c1efed797df7c3568a2bb7b45e3d7d450ad5fb229612485a3e77d6b8462fd95378c2d29
SSDEEP 1536:cPCHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQty9/+1jN:cPCHa3Ln7N041Qqhgy9/i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2864	tmp4EDB.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2864	tmp4EDB.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp4EDB.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2864	tmp4EDB.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3860	1672	3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe	83
PID 1672 wrote to memory of 3860	1672	3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe	83
PID 1672 wrote to memory of 3860	1672	3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe	83
PID 3860 wrote to memory of 3480	3860	vbc.exe	85
PID 3860 wrote to memory of 3480	3860	vbc.exe	85
PID 3860 wrote to memory of 3480	3860	vbc.exe	85
PID 1672 wrote to memory of 2864	1672	3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe	86
PID 1672 wrote to memory of 2864	1672	3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe	86
PID 1672 wrote to memory of 2864	1672	3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\la0dtpqh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES515C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc31DE81B0D1B347D19319D1752FF25A.TMP"
    3⤵
    PID:3480
- C:\Users\Admin\AppData\Local\Temp\tmp4EDB.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4EDB.tmp.exe" C:\Users\Admin\AppData\Local\Temp\3a67d5a900ea6f8e14d6ea964453b7a0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES515C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES515C.tmp
Size 1KB
SHA256 1447d7650753a830a2f84d2cc4e993da432507fc63fcdfb4e35d8f4220ff946f
MD5 0a7fb222b5e756ab7130d08051c853a5
SHA1 6aec4f450f22ff20b0da9194a3392076af48738e
SHA512 0682ed7910f787f16765309eb7a87ccdc1b01ef2f65cf2c7319b57e4ad210183b696ab9cfe7065395330088ba2cb383c6fd5d4ac5be3e73b6fc0338c9384cc85
MD5 SHA1 SHA512

Submit Download

la0dtpqh.0.vb

Path C:\Users\Admin\AppData\Local\Temp\la0dtpqh.0.vb
Size 15KB
SHA256 bc3e560984540b248d1c851452b15a473c8cb4aa2903a194789c3039e0b8d337
MD5 ca452a4971575aa9d273dfd7367be2a3
SHA1 f019d99db8b33cd28cb9cfeaf5705b1e65dd6638
SHA512 7a6781542573daf1e96005666e3cbf849c49d2a1a8be98f049f044422b9d6aaf7aa0f07a7e197e62f869796ad89c903344653fb5bbf33c1a63d1564aa734d369
SSDEEP 384:rxNDNVOFNENvzwRN9NzcHbVE6NCzN7QGSN7eP:3RkkQvzcH9ChX+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

la0dtpqh.cmdline

Path C:\Users\Admin\AppData\Local\Temp\la0dtpqh.cmdline
Size 266B
SHA256 9e12ac86654945a446021ab127dd8996781da0c8541d8cc83cfb1098a9926c14
MD5 7e2a025b4a62c676cbebe6fe5886d63c
SHA1 07fbe22f6763ac989bdb8d4f75db49e8fa197322
SHA512 b46cfd2885abc1b7ad5e001927fea15a677fdad545b960c535d1731c63ffb20a23243911f8b4df6316dd592f4fb47075bfee5d8335379ad7f8b5c38a6f13a1f4
MD5 SHA1 SHA512

Submit Download

tmp4EDB.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4EDB.tmp.exe
Size 78KB
SHA256 e345b18ba84f97ce70dbb3607564e61cec80ef3c2109f490f753ae3936cb2fdc
MD5 9147b012fd2d152da2376199fbac09e4
SHA1 4296bfe2e665e272aefc3373cecc00be36277928
SHA512 9dd0666f2951b186d6e650cfd2c6e96a421ccf650b02ba7128efe1aaf231da10c73f264554da924d869b19bea703c5a4868715f640c06bdee4aa375fb0160b64
SSDEEP 1536:H5jidy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6t9/+1XA:H5j9n7N041QqhgV9/z
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc31DE81B0D1B347D19319D1752FF25A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc31DE81B0D1B347D19319D1752FF25A.TMP
Size 660B
SHA256 1d943483f7fd233e3efb2e3b761c2d7a9abb0882b733d8187154f86b08c0e58f
MD5 5c5d6c875db6824190ae5becde84effb
SHA1 7425ccff314b9d2b0f062e89795487849e1ffac9
SHA512 f06ec018e657672819600c81be6e615181475eb9c9a2900a36fa53f4020dcda04fd0fda3cab0a93279aadec690f4df6ec632cc71da5f0f5dd6f090e9ac80fc54
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1672-22-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/1672-1-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/1672-2-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/1672-0-0x00000000749C2000-0x00000000749C3000-memory.dmp

Download

memory/2864-23-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/2864-24-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/2864-25-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/2864-27-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/2864-28-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/2864-29-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/3860-9-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/3860-18-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads