metamorpherrat | a07f9cfe5078ab201f1ffba911e3f6d17cdd8f8749c8f2429c8b9f8aa4eea5ae

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe
Size 78KB
Sample240619-nqasmstglr
SHA256 a07f9cfe5078ab201f1ffba911e3f6d17cdd8f8749c8f2429c8b9f8aa4eea5ae
MD5 b94f3ce5653c77053960e2b078db6b00
SHA1 11107a7877fdced0bfbc5a6c5739f4b9a9946063
SHA512 f26f39c8aca4f7029ffe3f77aa7849e3bc2e2fa8b2b804bb2edcaf876a76008a3dadeb1fb13cb0cd97047c089adeb2b48be8522575ac7a04b84a89066f5cb562
SSDEEP 1536:CCHHrdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLgs9/c1tX:CCHLdSE2EwR4uY41HyvYLgs9/Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1128	tmp4A96.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp4A96.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe
Token: SeDebugPrivilege	1128	tmp4A96.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4624	4480	b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe	83
PID 4480 wrote to memory of 4624	4480	b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe	83
PID 4480 wrote to memory of 4624	4480	b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe	83
PID 4624 wrote to memory of 4904	4624	vbc.exe	87
PID 4624 wrote to memory of 4904	4624	vbc.exe	87
PID 4624 wrote to memory of 4904	4624	vbc.exe	87
PID 4480 wrote to memory of 1128	4480	b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe	89
PID 4480 wrote to memory of 1128	4480	b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe	89
PID 4480 wrote to memory of 1128	4480	b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rbxvfgvk.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BED.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2A8546518E974704A66AE2947B918A74.TMP"
    3⤵
    PID:4904
- C:\Users\Admin\AppData\Local\Temp\tmp4A96.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4A96.tmp.exe" C:\Users\Admin\AppData\Local\Temp\b94f3ce5653c77053960e2b078db6b00_NeikiAnalytics.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4BED.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4BED.tmp
Size 1KB
SHA256 0a123f3504b372f3b0692cf0c3920b2b40bb81bf59baf8a4eac42dd1c38addb8
MD5 e08f535eb71897443d1de26169bf177f
SHA1 e9078efe242e64588b2446e8f159c1506797f2d1
SHA512 bda0c724ab817cf5fffcf39be13b5efeeeba247d14b13b36208c00bcc92d2adf9573370bb682a5f4f97b295ce9668954788f326a0d511220ef40d173c8db8641
MD5 SHA1 SHA512

Submit Download

rbxvfgvk.0.vb

Path C:\Users\Admin\AppData\Local\Temp\rbxvfgvk.0.vb
Size 15KB
SHA256 98a2774f9d6ff9bc092e23441d1cf254d2f36408fa61a88b249c69d9d27d9a8c
MD5 b3413d28e6f311288039725d32bc926a
SHA1 9539f9e35348654e12f3a278ae1f11d59ba7f93d
SHA512 d8b796f5ab5699e86998b9920c4c94ae3395a2af2867bc2882e7cd501d436030c6a1f5110de82998042c8284d83a1125e0f0a297fc4eb172acaeb90268f07629
SSDEEP 384:reNANMNsNvHP5N70JNucHbYE6NYzN7QrSN7eP:moMsj70DucHIYh6+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

rbxvfgvk.cmdline

Path C:\Users\Admin\AppData\Local\Temp\rbxvfgvk.cmdline
Size 266B
SHA256 22fdbf0f2e5fe246e3b60fe265ae1668de312f16b9de4828557f68c17039a01d
MD5 e298951de48df4919fe7357e125be5d8
SHA1 faa0c54a14c2fc775ec6964a67ef224bf68db089
SHA512 59abe71d26acd27597e738dc54ff64c3f8a6b1c67125f892528ecdeafa8166f8629eb589aa73b1e6000a271f440ecf3e5b65ba73bb573a27de4f9311de573881
MD5 SHA1 SHA512

Submit Download

tmp4A96.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4A96.tmp.exe
Size 78KB
SHA256 eb716df789e6645ada677d4eaac0297ac74476c92089289688f2adb7a35902ff
MD5 3569da0a4d23e4cce471442d58b8e109
SHA1 e4760297aedbc2211ef46adfeccd20dfdcef75db
SHA512 e1477235f20c50bd7aa38857d01b415a3cf2372ba684d9604cf3a5e73a0dc27bf476d525b803f1bc72db8f54019d1817e3c91309189d0dd018f6af9772e4644b
SSDEEP 1536:ty586LT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQti6/9/+1ZH:ty58kE2EwR4uY41HyvYH9/m
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc2A8546518E974704A66AE2947B918A74.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc2A8546518E974704A66AE2947B918A74.TMP
Size 660B
SHA256 61935f6d471f5bae0f2c9e792425006d475e2b7cdb666c2995306f1049684c10
MD5 a91b0807d83c091996fb0cd7ccca883e
SHA1 5f643fb80ca7b979ac983a452ad7f21213ea3faa
SHA512 a39702ea4693c337168ec4e4e57e35355dd6bfbda3b7c84a25a58d27bc632d23a3f54cb7949d375f6a3abbaf09df752f8c7239d423bf3051193131d9ef7d4dd8
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1128-23-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/1128-24-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/1128-26-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/1128-27-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/1128-28-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/4480-2-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/4480-1-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/4480-22-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/4480-0-0x0000000075142000-0x0000000075143000-memory.dmp

Download

memory/4624-8-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

memory/4624-18-0x0000000075140000-0x00000000756F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads