metamorpherrat | 2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe
Size 78KB
Sample240621-b8mtpsvglc
SHA256 2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c
MD5 a538ef614c075b91ba42b4d73a82d970
SHA1 d5d4e8b2a3a4d24ff6fbc5aa24e8d39cb8e4b545
SHA512 7f9b8206594cfed13e52dff093c6c51ed198c181039749ba7b6c7705b13fe2584c42e38168e235b1d8c9936cb08abfd0836f1d40f74605b329b3f4e73a0d674a
SSDEEP 1536:KWtHFo6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtk9/t1NX:KWtHFonhASyRxvhTzXPvCbW2Uk9/t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4060	tmpD9D5.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmpD9D5.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe
Token: SeDebugPrivilege	4060	tmpD9D5.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2752	2284	2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe	90
PID 2284 wrote to memory of 2752	2284	2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe	90
PID 2284 wrote to memory of 2752	2284	2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe	90
PID 2752 wrote to memory of 4944	2752	vbc.exe	93
PID 2752 wrote to memory of 4944	2752	vbc.exe	93
PID 2752 wrote to memory of 4944	2752	vbc.exe	93
PID 2284 wrote to memory of 4060	2284	2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe	95
PID 2284 wrote to memory of 4060	2284	2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe	95
PID 2284 wrote to memory of 4060	2284	2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe	95

C:\Users\Admin\AppData\Local\Temp\2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mlxuqz5f.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDAFE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B9DDEBBE30D49319F9C4FF3D09B8B.TMP"
    3⤵
    PID:4944
- C:\Users\Admin\AppData\Local\Temp\tmpD9D5.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpD9D5.tmp.exe" C:\Users\Admin\AppData\Local\Temp\2b670ac007a6d4125a6f51e8e3e1147a493ad361f57fb95be1fe1e52bdaf3f2c_NeikiAnalytics.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,3144109701624127473,12586215149656995128,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESDAFE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDAFE.tmp
Size 1KB
SHA256 d32b721cd5cc7d6d1b419de28f84f8738693b949102db9f69cd4e554fa93563f
MD5 52d18bc6664e1c9882207f022515d155
SHA1 9f83d9cd02ad2ad178f723a11566b786fe241134
SHA512 895ae79b484f34b88447b2bc7cde986be1b27072ae4f0be94018e90bf0c442f5e13dbe4671a333e13c25afbf9ac8e1f292412e4271c76fb4e8016dae38ae1ca6
MD5 SHA1 SHA512

Submit Download

mlxuqz5f.0.vb

Path C:\Users\Admin\AppData\Local\Temp\mlxuqz5f.0.vb
Size 15KB
SHA256 baea66239366a33c51b32704d9a9ca4839038bcffc339ae694808d3759f94fb0
MD5 c4a1d03e1b0926d3425feb6138ce085a
SHA1 2560d4cc26cced7fbd70a93efca9600eb878c2de
SHA512 440b380e5ded728cacf4310b035fe08c72fabfd99a3428196bc7f5ffbba139cf5ef9a5b1e9cc581d1d4f13f72c3ee9f5aff4e8bace265a30196d55d8d110b8d8
SSDEEP 384:rHNbNp/uNkNxRAPN77NScHbVE6NkzN7Q5SN7eP:hp5CEG7JScH9kho+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

mlxuqz5f.cmdline

Path C:\Users\Admin\AppData\Local\Temp\mlxuqz5f.cmdline
Size 266B
SHA256 878aa74af5fa594a5153430ad1ae677dd6cacb0d07518078d3afdf1f45b96988
MD5 5e1524bfb47bd4530716fe51c1faef9a
SHA1 11230002daaeade713c2473c79a05ad1ed2ca212
SHA512 a339760234a208c94486374dbc9447bf979ff6e57701ccb4d78e096e547eb2f79354cb644d9650a034b34c3f5299b31daaf52c63cd5bd58a93334061874e2895
MD5 SHA1 SHA512

Submit Download

tmpD9D5.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpD9D5.tmp.exe
Size 78KB
SHA256 a4589dcabddebf527e54a1d7e6c9a7c7d7e4f523a6370c7e8db08c3da41c4814
MD5 2677210fd8b9c3bdfa57ca143d2df07a
SHA1 ccd72bff41962f092f63331bfec709d180e63055
SHA512 dfbe2e23726fbb9e1abd5a1482ba585a543787d7ce11f44c2832a4ead906b19e4a606cc2fc11c2d370865b27292fe0aaa0b730bda411c866535d48c589e33fe4
SSDEEP 1536:F5jSAXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6i9/21GB:F5jS4SyRxvhTzXPvCbW2Uq9/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc4B9DDEBBE30D49319F9C4FF3D09B8B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc4B9DDEBBE30D49319F9C4FF3D09B8B.TMP
Size 660B
SHA256 fed6351c34badf9beaa1fb2b4a85ffd7b3717c825c4c8bd90d3b06dcd09121af
MD5 98262097e0fc537be526f07807c28073
SHA1 448d1aaa54a513171c5e243820fe10750755cd7e
SHA512 452a4949e45a32135f899ef881fcf3f0dc567571f918f3820bd2d0a3b21303b42e1a387c44a7fe2a3064a816e9e7b7e6ace513c4cbd601e485df8699302228c1
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2284-23-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

memory/2284-2-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

memory/2284-1-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

memory/2284-0-0x0000000074F02000-0x0000000074F03000-memory.dmp

Download

memory/2752-9-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

memory/2752-18-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

memory/4060-24-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

memory/4060-22-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

memory/4060-26-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

memory/4060-27-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

memory/4060-28-0x0000000074F00000-0x00000000754B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads