metamorpherrat | dda31ff2a785559db1b1ea15e809c4b8f2ad8825f9871482118dd39b66a003b0

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe
Size 78KB
Sample240601-hp1psaea54
SHA256 dda31ff2a785559db1b1ea15e809c4b8f2ad8825f9871482118dd39b66a003b0
MD5 91a73595f35b4a58c0b164491ccbf580
SHA1 26767d97d03c3e774e8c31e0b1be8e9e3c6aa05e
SHA512 0cd26953fd719beeb4c1896a2357fcfea3a80ec56d40296ad93b47d08de4555f052ad400bafd55d3e920f71d7a3ff203f56cce1c624ebb452d2a10dc0c373d20
SSDEEP 1536:Z5jSMLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6m9/Y1SL:Z5jS6E2EwR4uY41HyvYt9/d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3576	tmp3C58.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp3C58.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe
Token: SeDebugPrivilege	3576	tmp3C58.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4192	4076	91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe	91
PID 4076 wrote to memory of 4192	4076	91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe	91
PID 4076 wrote to memory of 4192	4076	91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe	91
PID 4192 wrote to memory of 3456	4192	vbc.exe	93
PID 4192 wrote to memory of 3456	4192	vbc.exe	93
PID 4192 wrote to memory of 3456	4192	vbc.exe	93
PID 4076 wrote to memory of 3576	4076	91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe	94
PID 4076 wrote to memory of 3576	4076	91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe	94
PID 4076 wrote to memory of 3576	4076	91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe	94

C:\Users\Admin\AppData\Local\Temp\91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wxtacuy0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41F6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc996C6E909E3A4F97BD2276E466DE4AAF.TMP"
    3⤵
    PID:3456
- C:\Users\Admin\AppData\Local\Temp\tmp3C58.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3C58.tmp.exe" C:\Users\Admin\AppData\Local\Temp\91a73595f35b4a58c0b164491ccbf580_NeikiAnalytics.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES41F6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES41F6.tmp
Size 1KB
SHA256 28300fdbabbff444c4743442356dcbf992077f1f97e78638c3d90ecbc6a814fc
MD5 56c2de8c39ea08d3c238a0a857845fdb
SHA1 2901bee505043a8e756c4f7e8661ff5d4a130d80
SHA512 a31904cdd5c62ab4407edffc97963fce0fb7dde35070443487e1cee5889d74a9216498f51fe7d0955eed6eed2933488148c5abbd1d38f359ef9ddb5b146bdd43
MD5 SHA1 SHA512

Submit Download

tmp3C58.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3C58.tmp.exe
Size 78KB
SHA256 bccd5dd3974e4073f700b234c5b494e2c75f0ec0bde059a27a1dcd834a70ec20
MD5 26215714f5cfd4f68aa8d6a5f12106eb
SHA1 88a9047e2c28f3d7fe6c48b74e551fd4dd169e3a
SHA512 fd2e893d060229894086b55c3d693eff1dfc171c780ed0e02b65f14e20fe02311d732f7fd966864154433e7c9e00c68a17f40eb3a0a06bf91f05ed3eb2d67235
SSDEEP 1536:jPWtHY6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtk9/b1o9:jPWtHY8dSE2EwR4uY41HyvYk9/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc996C6E909E3A4F97BD2276E466DE4AAF.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc996C6E909E3A4F97BD2276E466DE4AAF.TMP
Size 660B
SHA256 b5f980bc398673c752bd64021a7f5def2af7326202ee84205dbec59d1e031388
MD5 a06416e7d864b80e62ad55a6319c12b2
SHA1 1772cfa1b477d39eca7c8cdeaa82ff5bda6e7046
SHA512 1c01f21c04ae874d04e9d7fea5815f161e78449df17223bbe87f47f826edc3055a8c608e175a511370fc45ad9ced28bc0d6a79d9703c1673e5d4c715c5a7793d
MD5 SHA1 SHA512

Submit Download

wxtacuy0.0.vb

Path C:\Users\Admin\AppData\Local\Temp\wxtacuy0.0.vb
Size 14KB
SHA256 80ee1607c2275d63de2e247c6304b31b2ecff01757238da5a88b061e39989416
MD5 e89119cddec6eb17831d6cf261b162da
SHA1 148bf761927fe7c5069d21bc58e33b70e026e2a0
SHA512 948da6a7f3f34a5cf724164b5a18dfc59979ed137525e4ef63e94b06f58173b87cd8c42a2b1d4666bd851193789add10bd3fa48e17d75363c6365a4b762edb27
SSDEEP 384:r5N1NKpNHNvbdjGUNmSNLcHbwE6NzMzN7QrSN7eP:3HcthDLcHwzMhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

wxtacuy0.cmdline

Path C:\Users\Admin\AppData\Local\Temp\wxtacuy0.cmdline
Size 266B
SHA256 d249bde56dcb5f290f2231934e8236d5300ef08fad4337da3fd29d9ca3b99696
MD5 09b4bbcc5a96d134c22d691899a7088c
SHA1 e9e567d93e198c2e3f7f90a4f2928a580da153ca
SHA512 ec6384f2378dbddc5b23bca4c9d680ff2648716d61fae26331491aaa8c49c68159b6d00f7d458f8fbe495892d360b0a89bb9240451bd907bdc3a7e07454d2484
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3576-22-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/3576-28-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/3576-27-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/3576-26-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/3576-24-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/4076-23-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/4076-0-0x0000000074F82000-0x0000000074F83000-memory.dmp

Download

memory/4076-2-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/4076-1-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/4192-18-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

memory/4192-8-0x0000000074F80000-0x0000000075531000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads