metamorpherrat | 29267ab57e240f451f2dd54b8f53b2482436e711b3da8aff36165736e125e75d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe
Size 78KB
Sample240526-vm2khsed32
SHA256 29267ab57e240f451f2dd54b8f53b2482436e711b3da8aff36165736e125e75d
MD5 16b2b31f2a0e32aa587cdb6396d73480
SHA1 369257295cc6e33e38e7ede276e93c732c16b642
SHA512 e4d451cc0f38a8a6396d5689b0b9c06c8c804f91d33ef0901356e3f76d272f444eab3216265690f87548f34f40f0f1cc97ccd3d143eb7fe94e9235c39059c245
SSDEEP 1536:bRWV5jELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtS649/uVN1L:bRWV5jSE2EwR4uY41HyvYA9/q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2504	tmp5E3D.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2504	tmp5E3D.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp5E3D.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe
Token: SeDebugPrivilege	2504	tmp5E3D.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4596	5000	16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe	82
PID 5000 wrote to memory of 4596	5000	16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe	82
PID 5000 wrote to memory of 4596	5000	16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe	82
PID 4596 wrote to memory of 3084	4596	vbc.exe	84
PID 4596 wrote to memory of 3084	4596	vbc.exe	84
PID 4596 wrote to memory of 3084	4596	vbc.exe	84
PID 5000 wrote to memory of 2504	5000	16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe	86
PID 5000 wrote to memory of 2504	5000	16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe	86
PID 5000 wrote to memory of 2504	5000	16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ubbsvpfk.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FC3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc42D137DCA1444D18A4BAED3F9F1B6B.TMP"
    3⤵
    PID:3084
- C:\Users\Admin\AppData\Local\Temp\tmp5E3D.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5E3D.tmp.exe" C:\Users\Admin\AppData\Local\Temp\16b2b31f2a0e32aa587cdb6396d73480_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5FC3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5FC3.tmp
Size 1KB
SHA256 daaaaa2015124266736e6bdc62bc4bc545496ea4b0ce4e1640917f9d8854273c
MD5 85e9e6dd14dfa4a77ea87af7632ffb3a
SHA1 f1b378ea587190326e5ebd24f963ea737452a1cd
SHA512 af8e1ab7c52b329ec3ecb2f5bb705cf673e27cbbfc7c5f8cc91ecab4b36d2ff1aae8589f05b02a10bc81161e16b9180219bedb77ab31d092360773dc09599011
MD5 SHA1 SHA512

Submit Download

tmp5E3D.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5E3D.tmp.exe
Size 78KB
SHA256 4df363f3135f18714e15fd77c2a6e53944a01f9e7fd5fa2194dbb1c8a9c5f9dd
MD5 32702d97f7494ead3e00f07b4db086fd
SHA1 05523fef95aaed77b9d8354959a41f3b05308105
SHA512 1a13e815d751b8b609884c8023745ddec0d023161e47c3ab2e0c0410632e40379004dc4515a9331531611da8b783000834c6bbb437084805157f5dc5e67269f4
SSDEEP 1536:UPCHY6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtJ9/kP1Df:UPCHY8dSE2EwR4uY41HyvYJ9/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

ubbsvpfk.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ubbsvpfk.0.vb
Size 14KB
SHA256 69e8d8f5c0dccec45990d0dc6d80bd657cf39d7e84d58e68bb12ea2dbcec16b4
MD5 2cfd9351a541247fae6f91cac49f0ef3
SHA1 0d1bbaded594f164cbdf8075209532ce7143d171
SHA512 0d9837a6fc7b2aa1636d25fc99e4d436e4216f57a4ac24ecbe9c9fd9343218220443bf96eaeb665ccc57264718a9b35cb84cd9152c2b0605907d65f975bb092a
SSDEEP 384:rDN7KSNeENkNGbdjTNl0QNLcHbwE6NzMzN7QrSN7eP:drzEKlVLcHwzMhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

ubbsvpfk.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ubbsvpfk.cmdline
Size 266B
SHA256 6981b5700c514942152aa3149e1bdaaf35949f91f6d37473d87f04c0daee2a08
MD5 436196f2fb7ce534472ffcc13b55df60
SHA1 d80f9afd7e8c3a9909b1b1e9f9265f52074d1927
SHA512 096e67d14caa0c88f7394ede7dd8d6b3c775ddb0c00e8f5444c60a7fda926ed97afbd0147bb567250a73e67664c68c914148ee8e3117bc9339b27d98413a1edf
MD5 SHA1 SHA512

Submit Download

vbc42D137DCA1444D18A4BAED3F9F1B6B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc42D137DCA1444D18A4BAED3F9F1B6B.TMP
Size 660B
SHA256 67661e7429fe6db80309db6f6a79f6af7caa1fa386bceea2c0c1fe44bfcdf2b1
MD5 4fbee807a0104f21dd07072e895c4e29
SHA1 4851219c5b1191f0885840cf1329c3ec9ad56ee1
SHA512 748d23212d1d4a04a7e19fefee480d506022d2c452c71a4ef2460c04922fd94b765c55814daad5ddabef994d0ef1b81194b0a265a93ea1dead0e217d742e4330
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2504-23-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/2504-28-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/2504-27-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/2504-26-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/2504-24-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/4596-18-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/4596-9-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/5000-22-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/5000-1-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/5000-2-0x0000000074850000-0x0000000074E01000-memory.dmp

Download

memory/5000-0-0x0000000074852000-0x0000000074853000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads