metamorpherrat | 8950816c72fea432283f67a783533a3bb93674eee8f9217b0fc640d4df9d915b

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe
Size 78KB
Sample240519-h2ecbaga69
SHA256 8950816c72fea432283f67a783533a3bb93674eee8f9217b0fc640d4df9d915b
MD5 9d38d88544c15894b3a6ceb50296c670
SHA1 988313e01c45a7e5c563c057b10f3b9013e5fc1b
SHA512 204900fd1594073e8009f7aa76e8a6f21b9cdeac768cff5b30ae8061d150bc827fba6a05f2db06dc99edf03dac6af351e2696afd971eec0348bd7e93697d1b5f
SSDEEP 1536:rPy5jSNdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96e9/2D/1ez:rPy5jSYn7N041Qqhg59/2Dy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
4088	tmp5832.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4088	tmp5832.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp5832.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe
Token: SeDebugPrivilege	4088	tmp5832.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4308	2608	9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe	83
PID 2608 wrote to memory of 4308	2608	9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe	83
PID 2608 wrote to memory of 4308	2608	9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe	83
PID 4308 wrote to memory of 1852	4308	vbc.exe	87
PID 4308 wrote to memory of 1852	4308	vbc.exe	87
PID 4308 wrote to memory of 1852	4308	vbc.exe	87
PID 2608 wrote to memory of 4088	2608	9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe	88
PID 2608 wrote to memory of 4088	2608	9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe	88
PID 2608 wrote to memory of 4088	2608	9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\luucdk2c.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B01.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1B5644986C87420E8E1CCB76FF9D99DD.TMP"
    3⤵
    PID:1852
- C:\Users\Admin\AppData\Local\Temp\tmp5832.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5832.tmp.exe" C:\Users\Admin\AppData\Local\Temp\9d38d88544c15894b3a6ceb50296c670_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5B01.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5B01.tmp
Size 1KB
SHA256 9a0aff39fb45b0ac4e7eedbfd14a51ea0887eaae6a8d15d8a423ca6e8c73a08c
MD5 ce43b383a59f5525f2fd3b6731683d78
SHA1 55cd04092b7bc80140266428c565285e766cd5f0
SHA512 d619dbb9ff7c020b1310bd83202b29eb5a36f13b90babff5de878e3a6f84fad4246b4757dcde67647add5620e52c31f1965e0868f8b356e0cda3681360a8248c
MD5 SHA1 SHA512

Submit Download

luucdk2c.0.vb

Path C:\Users\Admin\AppData\Local\Temp\luucdk2c.0.vb
Size 14KB
SHA256 ce4227daeee9e9537011643f9dab58f30169ffe1ae91a01ecd01beda6bef1192
MD5 18877ae3fb50bee7186d7f7ec92a06aa
SHA1 beccc77f693b9d521828260535c8df3da2f75981
SHA512 27127644962d9f17d19cf2cfa70f7cfe0b515dd739848b175279b61ea7490aed8caf7b1e0c03962cbd801dad4141ab0cafa0d21ecd0246bc6826bbfb6dee04ea
SSDEEP 384:rmNsxhNUuTNvbMNRhVlnDN8NucHb+E6NLzN7QZSN7eP:esxbUuBzMRflRcucHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

luucdk2c.cmdline

Path C:\Users\Admin\AppData\Local\Temp\luucdk2c.cmdline
Size 266B
SHA256 3b828c12b828c49dd730f0a61304c570ed40ab53c6243f7d2a650fa0b59eb3e1
MD5 a10a6c942b3a57fee2c4e69d139d609d
SHA1 06d88b44e63f2c5c15d52984bf01726351942019
SHA512 07f8b71de8752c980d7c75eb06996f68e158b3c82cbf8eeae02b8c16fb373155de3fa150dc5dcf7c0833cd4b88654cabc9952f9c7774ec36cb43176e5868029e
MD5 SHA1 SHA512

Submit Download

tmp5832.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5832.tmp.exe
Size 78KB
SHA256 fea7574125daa1b8bfc12eff7b69078fc7995008ed2cd26d68c9973599b44f79
MD5 a166a974a301f50abf987407d7805c07
SHA1 d7e09c5989b3cbd619efe9a402a7460e3a96a5bd
SHA512 5df197ee51e653e19cc5af2c9be0beabeeb1413874f70e0e2c1f441400131fb9c8331e8a68d6b300d976a134b2745f83c9448adb62d452ef42b7659b6d65c6bf
SSDEEP 1536:BsHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt99/g1co:BsHY53Ln7N041Qqhg99/k
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc1B5644986C87420E8E1CCB76FF9D99DD.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1B5644986C87420E8E1CCB76FF9D99DD.TMP
Size 660B
SHA256 7011c920df8b0489f4cefef1e3840bcacd03b562d8c88dd0fbeaf642b19ba1bf
MD5 d0a7548f2d41191edddf1e430a111b54
SHA1 a6fbe5935488a58721977cce9e7fa0440e6d5bfe
SHA512 b4d4cb16a6f111a5a1a509215b4a2a6d241fb65ddf8e37d6828e49af913e2f1b5b45f42cdab5d5afd5c6f3bbb3121ba91e562e70482cf29febd1f0e9aca2e547
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2608-1-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

memory/2608-2-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

memory/2608-0-0x00000000746A2000-0x00000000746A3000-memory.dmp

Download

memory/2608-22-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

memory/4088-23-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

memory/4088-24-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

memory/4088-26-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

memory/4088-27-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

memory/4088-28-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

memory/4308-18-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

memory/4308-8-0x00000000746A0000-0x0000000074C51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads