metamorpherrat | 2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699

General

Target

2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe
Size

78KB
MD5

42c15c189c4ac429f658668e3ac742a7
SHA1

93e00f46114bf5b6e7d3e2f288ba3ab9746f5565
SHA256

2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699
SHA512

2b22b40ef58051286f22431bcddef45e8730a2c3266f03048aef1c03f8f8efc0a233e0119bff462f1f599e8951f45834bc368797920ba4dd5b083d92d1b46947
SSDEEP

1536:WuHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtei9/X1cK:WuHa3Ln7N041Qqhgei9/x

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe

Deletes itself 1 IoCs

Processes:

tmp42C6.tmp.exe

pid process

2140 tmp42C6.tmp.exe
Executes dropped EXE 1 IoCs

Processes:

tmp42C6.tmp.exe

pid process

2140 tmp42C6.tmp.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
2140	tmp42C6.tmp.exe

pid	process
2140	tmp42C6.tmp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tmp42C6.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp42C6.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exetmp42C6.tmp.exe

description	pid	process
Token: SeDebugPrivilege	1460	2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe
Token: SeDebugPrivilege	2140	tmp42C6.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exevbc.exe

description	pid	process	target process
PID 1460 wrote to memory of 800	1460	2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe	vbc.exe
PID 1460 wrote to memory of 800	1460	2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe	vbc.exe
PID 1460 wrote to memory of 800	1460	2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe	vbc.exe
PID 800 wrote to memory of 2360	800	vbc.exe	cvtres.exe
PID 800 wrote to memory of 2360	800	vbc.exe	cvtres.exe
PID 800 wrote to memory of 2360	800	vbc.exe	cvtres.exe
PID 1460 wrote to memory of 2140	1460	2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe	tmp42C6.tmp.exe
PID 1460 wrote to memory of 2140	1460	2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe	tmp42C6.tmp.exe
PID 1460 wrote to memory of 2140	1460	2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe	tmp42C6.tmp.exe

C:\Users\Admin\AppData\Local\Temp\2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe
"C:\Users\Admin\AppData\Local\Temp\2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hixex8pd.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES446B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4024392580BA4C48BFA95F9F44F9232.TMP"
3⤵
PID:2360

C:\Users\Admin\AppData\Local\Temp\tmp42C6.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp42C6.tmp.exe" C:\Users\Admin\AppData\Local\Temp\2e548d6fa2b335d39db8ff5f2cc529089e423d6345d5db49a663b5c910671699.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2140

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES446B.tmp
Filesize
1KB

MD5
9a9c3b5b754a8b70d46fd2f1cd9910e1

SHA1
94383c7828441e1dd75072abd2a571619090e077

SHA256
9f5757b1cf41e81fc538d7903b8d9485696ee74dee19fa05f0c8f33218035a86

SHA512
0114cce90cefc60b6dee87dbc4a282d0ceaf65b4a02cb49e5edf4df83e32419c720d2d2f249de678a72e48667515be4562630f2c380f268122af4262fa10feea

Download Submit
C:\Users\Admin\AppData\Local\Temp\hixex8pd.0.vb
Filesize
15KB

MD5
d38ca5c46648eb48d018a95f20663f58

SHA1
e7ddd644556dd66a0651dcc4928d38d1db7ee871

SHA256
e46f110a34114045e9a6b30b8b06e9e6ec16e942fd1260be1310690f705f1fc4

SHA512
cf19a3ffbe0b1f274c43075f266dbf5e5276afbdb371bdff509be2cb30d29940ca7d8f7154b73f9b69efdf716285c499cab6ea03a8523a6b88b59cf24b1417ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\hixex8pd.cmdline
Filesize
266B

MD5
0508bd4207213298131bfd9070fcae20

SHA1
aea101d120aac5e15f86402800de063a3f003e3a

SHA256
6537097891258dc291a5c97b1a17b118b91b3a0070e6e751905855dabc775ac5

SHA512
e3e1f2dcca59b77761cd70620960f01b975f07e361fa33091fb4e5130e2ad02d92023b78a5632cf40d100ea2d9ece18e1bf37bc430c80d5c30fecc440310e81c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp42C6.tmp.exe
Filesize
78KB

MD5
6eddab3564c5a2175e8adb9e2538cd8e

SHA1
0c974aba30460e5ff4c2eabf3018c6e4d379060b

SHA256
331f302225b5c17856cae0e31732e259b2ff6f1c54f556a0121e0989ed7df6a8

SHA512
e50000dd82e72ac18538f56161aa0252a47b34eae4f8c360d2b02bdd19f7d01f7e806de753ea78658b98ac6ec9b10e26cfe4077ba9a50379102c8caa9f48aecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc4024392580BA4C48BFA95F9F44F9232.TMP
Filesize
660B

MD5
b4975415c244108bc8f6abc0a152db39

SHA1
1d1bc767bd0d40f0ecaeee7fbbef003cc554f843

SHA256
4a0eb76af999d804049a998a35763a5f3f2c644d5bea6701a3114cbc777719b2

SHA512
63f3f8a10188aa10507f2f4feac1e371ef16ef004b6afbff0e6be6bdf11e56bdbf983e6f524f87c2759eaefceb9e943424ba65300696a5254cb3da141a9a8a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources
Filesize
62KB

MD5
aa4bdac8c4e0538ec2bb4b7574c94192

SHA1
ef76d834232b67b27ebd75708922adea97aeacce

SHA256
d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

SHA512
0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

Download Submit
memory/800-18-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/800-9-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/1460-2-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/1460-1-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/1460-0-0x0000000074F82000-0x0000000074F83000-memory.dmp

Filesize
4KB

Download
memory/1460-22-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/2140-23-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/2140-25-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/2140-26-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/2140-27-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads