metamorpherrat | d677e96ea93d57b932c8f1fd8685ba6b8fdc555e318f9a3a4b7f5413d7c95976

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe
Size 78KB
Sample240530-elyt8sdg8v
SHA256 d677e96ea93d57b932c8f1fd8685ba6b8fdc555e318f9a3a4b7f5413d7c95976
MD5 6386a13edc662ff62c8702311a946510
SHA1 b40dfdb57c4108b4acad22b85e8b9fed60e7ac4e
SHA512 7bb14c1d6e54057558edf98b26460877111666d4795c4628525eae36f6dcb705f2256dfc1f1c1e8ed5248d64b441cc5c731d015a0509b409e612c6960250d7aa
SSDEEP 1536:BCHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtV9/Sh1xh:BCHY53Ln7N041QqhgV9/A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2296	tmp5999.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2296	tmp5999.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp5999.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe
Token: SeDebugPrivilege	2296	tmp5999.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1612	4680	6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe	83
PID 4680 wrote to memory of 1612	4680	6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe	83
PID 4680 wrote to memory of 1612	4680	6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe	83
PID 1612 wrote to memory of 3272	1612	vbc.exe	86
PID 1612 wrote to memory of 3272	1612	vbc.exe	86
PID 1612 wrote to memory of 3272	1612	vbc.exe	86
PID 4680 wrote to memory of 2296	4680	6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe	87
PID 4680 wrote to memory of 2296	4680	6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe	87
PID 4680 wrote to memory of 2296	4680	6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe	87

C:\Users\Admin\AppData\Local\Temp\6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i56oft6w.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AB3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB3765436E0D4D2FB926C55CBA71825E.TMP"
    3⤵
    PID:3272
- C:\Users\Admin\AppData\Local\Temp\tmp5999.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5999.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6386a13edc662ff62c8702311a946510_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5AB3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5AB3.tmp
Size 1KB
SHA256 105376f0ec98eab8634d661f4297dbe4644df387c9d234f1daca2510a1216eba
MD5 afa6a4011b4f30c71624d82e7d74763e
SHA1 a70ee608a0e510695192931ed440f6af894049e2
SHA512 7690e53d3f07bc5fae6225a0f7a3064a3749a65e992a3a15bb2e336fd83a74cbb24264f87da8f20d8598a98b7ce09b5ac0983217285d060b81703e0c5b826482
MD5 SHA1 SHA512

Submit Download

i56oft6w.0.vb

Path C:\Users\Admin\AppData\Local\Temp\i56oft6w.0.vb
Size 15KB
SHA256 3dff3373c5e31be5267aa9ab2828b66bf0fc33e150f46be66fb11c4f5a48cebe
MD5 6108c8a873d4154ba2c9815a7430ef1e
SHA1 d4b989e35ca241c2942094ce2f2b4a82fe400c4f
SHA512 67f5af6c2130127e93d90489dae6d28098052ad3058d862097816873b0bef246bf97b716cc0916c6b34868b74c69b0e0658e1a77880d7dc57d1c972c0be0986b
SSDEEP 384:rCNEUWNgNvDNpNwAtNZiNpEcHb5E6NSMzN7Q2SN7eP:qqgfjJZupEcHJSMhn+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

i56oft6w.cmdline

Path C:\Users\Admin\AppData\Local\Temp\i56oft6w.cmdline
Size 266B
SHA256 0b203a3c9b196a1b6f424b4fc5e58823d1a69dadc34d952f17323cdeff68b2aa
MD5 dbe2f0be4f81cdcbaaca1c666fbcd5ee
SHA1 cc3f3c8723cc37757243c38cd851ccd31349dad9
SHA512 58233561c7e7c217e2cd19eb1d216894b6073e495cffed2b60d39152e5af6dfaa025cf7746d410693ae8e1ca2a60b1082b3de0a8ddbff3a74c8d1a135a09842d
MD5 SHA1 SHA512

Submit Download

tmp5999.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5999.tmp.exe
Size 78KB
SHA256 725718dcbbe6abacd38ce6b3324e991776bf310c94f2e78570363ab176280d8d
MD5 611476d3064d77eb31d919da6b3a7863
SHA1 b78da371659789f5e9972d0a681257fd9cb0defc
SHA512 b0c61c4d684dd1fba0ca2acd513650c9a0ad767ef34b6fb57ea21103373655c4c1cfe8f97f52760098892ec8351dd815d8d45128f44bd503d4788302ee3cc4b4
SSDEEP 1536:LWV5jS/dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96p9/Zn1af:LWV5jSen7N041QqhgK9/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcB3765436E0D4D2FB926C55CBA71825E.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcB3765436E0D4D2FB926C55CBA71825E.TMP
Size 660B
SHA256 c5ea74f379f34d372bcb7ea92cb06b5c03aca903ee3c46fd62adaf8d50e57adf
MD5 041b837c3e572e9412a72f984a61b94f
SHA1 dc86985ee4198753e286b00e1c3c6dd9f3078e83
SHA512 babcda4fd87100f5f6b7aba66d507589d6f9e1153a1acbbc71a1dfc794bf6fc90cf5d99b9b0fbfcce9fbcff31e55eeb55b892abca9dc833453bd7ceecb04354c
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1612-9-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/1612-18-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/2296-22-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/2296-24-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/2296-26-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/2296-27-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/2296-28-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/4680-2-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/4680-0-0x0000000074DB2000-0x0000000074DB3000-memory.dmp

Download

memory/4680-1-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

memory/4680-23-0x0000000074DB0000-0x0000000075361000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads