metamorpherrat | a097652d753f0dba6d2028caab8e4f3a27fddadb4c9de7c00bb6bd3e0e647f27

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe
Size 78KB
Sample240526-scdplabb47
SHA256 a097652d753f0dba6d2028caab8e4f3a27fddadb4c9de7c00bb6bd3e0e647f27
MD5 0b72c0411c42339fd35e38a617954f90
SHA1 63fb612b2ea4b1b4cf9861786ca82e0a99effdc3
SHA512 082d7c37729e8519faa6fae4ccb8cbbd030384000c6ed0ed87d3b6a5aa3772e612252cd98ffdfcf22a68ecde5be4b0bf592e0d4a9734322bc38479e850abdc7c
SSDEEP 1536:nPCHFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt9/R17V:nPCHFo8dSE2EwR4uY41HyvYt9/F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1284	tmp3C1E.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp3C1E.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe
Token: SeDebugPrivilege	1284	tmp3C1E.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 1776	4552	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	82
PID 4552 wrote to memory of 1776	4552	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	82
PID 4552 wrote to memory of 1776	4552	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	82
PID 1776 wrote to memory of 3980	1776	vbc.exe	84
PID 1776 wrote to memory of 3980	1776	vbc.exe	84
PID 1776 wrote to memory of 3980	1776	vbc.exe	84
PID 4552 wrote to memory of 1284	4552	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	85
PID 4552 wrote to memory of 1284	4552	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	85
PID 4552 wrote to memory of 1284	4552	0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rhvvme8y.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E22.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF8D0803A598842B7A617B9D5C30E32E.TMP"
    3⤵
    PID:3980
- C:\Users\Admin\AppData\Local\Temp\tmp3C1E.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3C1E.tmp.exe" C:\Users\Admin\AppData\Local\Temp\0b72c0411c42339fd35e38a617954f90_NeikiAnalytics.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3E22.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3E22.tmp
Size 1KB
SHA256 a8eb64213d54da750743fd3598278f13530bd3fe5631f24a190751a58c7a6c5b
MD5 59d0b7c197de776c445c86dcd956101e
SHA1 877dc9300748a653cfb9ecb23472860d9d87e1cc
SHA512 68d88ac3ad5d0ed8b08b6d3cc7ba75c56393c025c8286f29dc132495cb1b2cdcc3cce5d84c46fc45ee5e4ca60e60463326c5d1e2dce3bf5214749e5677faa78f
MD5 SHA1 SHA512

Submit Download

rhvvme8y.0.vb

Path C:\Users\Admin\AppData\Local\Temp\rhvvme8y.0.vb
Size 15KB
SHA256 0ae9814445d3399bb2f4b042a122e71040bd2b6108109a451148ebbb291a9597
MD5 8a66855ae5a4c262742cad35a250f035
SHA1 74737dcd87363286f233c2f49ed3f53cac0f2402
SHA512 f94d992f22fa08a6e4b11a6b5c954393cd71a70d0e9185450fe9d804fd2588bbbcd1f4189119493d8c7507961e57355d2d034af9997184b0bb3081978819a394
SSDEEP 384:rsNpzNjCNmN5RVNsNHcHbME6NBzN7QISN7eP:ophjO6DsHcHEBhJ+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhvvme8y.cmdline

Path C:\Users\Admin\AppData\Local\Temp\rhvvme8y.cmdline
Size 266B
SHA256 83d2dc77cfeccde72d6bcbffd82a9f5b06a8cb530f75cf3718e7ad92570f8d31
MD5 c1c5a3c18d2706755ffbc30455822a14
SHA1 3c80bbfec5f8f702a35aa2fecadffc9a2a3897f2
SHA512 792c126252468ed480b0dcee572b0026ca779e57267c9af8f56ceaf748d182e07752e4ef3c0b8ee6a64dab47cf528e17c4157b18478bdbdee09d179239d974d8
MD5 SHA1 SHA512

Submit Download

tmp3C1E.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3C1E.tmp.exe
Size 78KB
SHA256 45f72c4a4e73898469b2caf15a4fe3e3a15deed7ef06fb540bf1a6199fd2f2e0
MD5 294cae494c81cb9a44fbd2b29c1e76ce
SHA1 982a5ddba830f0884f5378b2f3736f96c81aff41
SHA512 d4619c84059d5b29df31f55d4865f41ae6e2570512fc6e9d42edcd0c889f8b94d88f419c4f7846b96ba109747dce16fd9b79cd9a858863434fff70143b3a635b
SSDEEP 1536:SV58iLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQti6j9/6t41Oa:SV58sE2EwR4uY41HyvY79/ms
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcF8D0803A598842B7A617B9D5C30E32E.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcF8D0803A598842B7A617B9D5C30E32E.TMP
Size 660B
SHA256 e499637f6e440fed25159b92de96cb4bc260939e6409427f0cc29d3800c87188
MD5 834fdd72581612c013ca4cbd39827ab8
SHA1 66c1ee95cbc4a1eb27a22a8e77b3d5f5cca9f2e5
SHA512 b4ff609c45dd13f9bbd67d685fd92979f060f38675e865ea9eecc65f960a49fbb87ae490df39cabb7280c5e8ba2cfae13db1d9a095cb600b486313db44b50adc
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1284-23-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/1284-24-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/1284-26-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/1284-27-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/1284-28-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/1776-13-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/1776-18-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/4552-2-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/4552-0-0x00000000752A2000-0x00000000752A3000-memory.dmp

Download

memory/4552-1-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

memory/4552-22-0x00000000752A0000-0x0000000075851000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads