metamorpherrat | 7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe
Size 78KB
Sample240523-3f9ljsdc4z
SHA256 7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469
MD5 b2d39302228d8f25e41d22483dd7a26f
SHA1 a02d07321cc289940e5c4aab543246f85d353d9f
SHA512 5e547f17ca100f8fbb58fdfdae605e115b3437af8f759a4033b1c68bf131dec150b0db65fc3a91ce1d759ceefc5746bebc8ea1520ca082522117258c37418a4f
SSDEEP 1536:VtHY6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQt2b9/w18c:VtHY8dSE2EwR4uY41HyvY2b9/A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe

Deletes itself 1 IoCs

pid	Process
4268	tmp7762.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4268	tmp7762.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp7762.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe
Token: SeDebugPrivilege	4268	tmp7762.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 3212	3332	7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe	85
PID 3332 wrote to memory of 3212	3332	7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe	85
PID 3332 wrote to memory of 3212	3332	7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe	85
PID 3212 wrote to memory of 2280	3212	vbc.exe	87
PID 3212 wrote to memory of 2280	3212	vbc.exe	87
PID 3212 wrote to memory of 2280	3212	vbc.exe	87
PID 3332 wrote to memory of 4268	3332	7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe	89
PID 3332 wrote to memory of 4268	3332	7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe	89
PID 3332 wrote to memory of 4268	3332	7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe	89

C:\Users\Admin\AppData\Local\Temp\7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe
"C:\Users\Admin\AppData\Local\Temp\7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\szq8v55g.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78AA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc90C7D6F9E81E4A7983E2F03C90ED498E.TMP"
    3⤵
    PID:2280
- C:\Users\Admin\AppData\Local\Temp\tmp7762.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp7762.tmp.exe" C:\Users\Admin\AppData\Local\Temp\7a21df2b46df9842c9d0015db267a637a59512a9c8700aa30044e4666a250469.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES78AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES78AA.tmp
Size 1KB
SHA256 7041dcf52f3ce8e47716912ff7858a0371ac1ea417bffdd8c326519ca4b2f585
MD5 f8069a39b6ceeb865e68c1b0cae6c342
SHA1 92a6d64d0329a35abac5cd418de576079ec1c560
SHA512 8f1743169bd9c1f101e0f2819544b97e969de1ec22a3b01fdf5d64be35ab05447893274d18d119e7ab941e3a8bf5d176fc3d830517993983a2427be5eab51d75
MD5 SHA1 SHA512

Submit Download

szq8v55g.0.vb

Path C:\Users\Admin\AppData\Local\Temp\szq8v55g.0.vb
Size 15KB
SHA256 2365b890ba58944a05fbae32dff52d1738619d2074d774b0d6332ea0f4580a6b
MD5 d39659b76ed423e0be7d43c62edce9a9
SHA1 f5fe673290f89374078e78cc0443c14c33d389b7
SHA512 95f194d3caf3e11f487d2e371511514d716256fe73c38ed5407ae3837c8628b159df8a9e3cca0bf66ccd22e67fb21b29ee069df13de28276e420268e062b7ec4
SSDEEP 384:rwNVNFN8NutVxNoINscHbRE6N6JzN7Q4wSN7eP:sn3c4fscHpAhM+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

szq8v55g.cmdline

Path C:\Users\Admin\AppData\Local\Temp\szq8v55g.cmdline
Size 266B
SHA256 6f68e7b0c6a1da2f6b1b984d5807e51799232beb0fc38da3bd76c69997ae9f4a
MD5 23eb3d85453b73ac4aa23276b97d5942
SHA1 c33a68dff168dc02c11a2f1a5c4141da2582a7cf
SHA512 e911ae6d15e89f26172c491d9dbadc91e66c2f1b4f605b55cfa041c00a3a47432bcfbe18790f2e7017ee5842b7cc40f61cc6edbe2ec680106ff600462532f5f7
MD5 SHA1 SHA512

Submit Download

tmp7762.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp7762.tmp.exe
Size 78KB
SHA256 19c67c09f297384a0a6711b2fef80f51132b63293182d9964b89a7302c2b036f
MD5 bc326383fb80aff5741fbcfcea908b42
SHA1 90fbfcae26e508d73c1b514075117007d86ad780
SHA512 81695469345ebd1223bc010f01756452d186c8cd6da89861330c019c8d2237da760a4cd87308d6869cf621bdce41f36cd5ab205d443fdd14025efef745805b93
SSDEEP 1536:i5jSMLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQti699/I1iF:i5jS6E2EwR4uY41HyvY19/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc90C7D6F9E81E4A7983E2F03C90ED498E.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc90C7D6F9E81E4A7983E2F03C90ED498E.TMP
Size 660B
SHA256 92c9bc2a37c257c5b5295458320d52153d3b02b9218e05d2d43a12bce2ff475c
MD5 19b7c86ce9df6ce20709ae91557fc031
SHA1 fcbb75e924cc47151e98f6c33510465cb843520b
SHA512 4e0968ed713f308cd1525fb912c18152d19bbccb3d99509ef605fef317da84eff2ce44458b895b35a262cef42b2df4fcaa72d343bf374185ec140fb58765b565
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3212-9-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

memory/3212-18-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

memory/3332-2-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

memory/3332-0-0x0000000075212000-0x0000000075213000-memory.dmp

Download

memory/3332-1-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

memory/3332-22-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

memory/4268-23-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

memory/4268-24-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

memory/4268-26-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

memory/4268-27-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

memory/4268-28-0x0000000075210000-0x00000000757C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads