metamorpherrat | 54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe
Size 78KB
Sample240625-mmszdavbpf
SHA256 54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff
MD5 8ab24d8f1612527ffd0db68aecaa9df0
SHA1 50ccfd2019df77fe11af4aaa026ed680722c858f
SHA512 83340a4ad6dc9ca8ba7443e0707167d8e90f9841fc69644b9be2ecaea6ed3b5ffb66d2e24806f373ef233268fa5e0d700995b160e36e06ae1602cb7cd73bc68a
SSDEEP 1536:Xe58BXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtN6C9/8Vd1E0:Xe58BSyRxvhTzXPvCbW2UF9/8z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
2072	tmp4391.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2072	tmp4391.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp4391.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe
Token: SeDebugPrivilege	2072	tmp4391.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4728	4380	54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe	80
PID 4380 wrote to memory of 4728	4380	54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe	80
PID 4380 wrote to memory of 4728	4380	54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe	80
PID 4728 wrote to memory of 1372	4728	vbc.exe	82
PID 4728 wrote to memory of 1372	4728	vbc.exe	82
PID 4728 wrote to memory of 1372	4728	vbc.exe	82
PID 4380 wrote to memory of 2072	4380	54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe	83
PID 4380 wrote to memory of 2072	4380	54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe	83
PID 4380 wrote to memory of 2072	4380	54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nlvoca9j.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4556.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7EBA292844CD49019CC5515FE45FD86D.TMP"
    3⤵
    PID:1372
- C:\Users\Admin\AppData\Local\Temp\tmp4391.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4391.tmp.exe" C:\Users\Admin\AppData\Local\Temp\54abcccf68edfd6773f6a281c80272a8050b95c690fe3d1f82a02dd09fb1d6ff_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4556.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4556.tmp
Size 1KB
SHA256 e1480054b3dc572078195dbb7e3415442c924c404eba6b98b9211ccc75cfd19c
MD5 e408098b72ccaaa3bec8d908f10f1262
SHA1 72a374d1bda17a93540a3d3f34a63db2b04a6182
SHA512 1edd7acd9f895dab3c56fe32e26f02b46393135195adfe5aa0a9bdcae1e40abce8875754121f68ce90cd0d154f4808085949be4132921a1c6f364da880beb176
MD5 SHA1 SHA512

Submit Download

nlvoca9j.0.vb

Path C:\Users\Admin\AppData\Local\Temp\nlvoca9j.0.vb
Size 14KB
SHA256 ba3f742554d74bb3c26ba5b5debf2350bcc68bbb5434094c399f18d05db7ab75
MD5 4db79d0aff13677d4414eaefe5289310
SHA1 c7f503b038689a000e000f93ffcfef308cc04e55
SHA512 1b027528623d4c1d24b66f37f057b700a7c08bf384c69661f5fad6cd2bf95b9105c457cd7e88c2e613e770ddead2da65aa199824f09ad028171f20e820272aa8
SSDEEP 384:rBVN5JNWuNXNOgckFzdDNM0N/cHb4E6NUzN7QPSN7eP:dn5DxdFLRh/cHQUhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

nlvoca9j.cmdline

Path C:\Users\Admin\AppData\Local\Temp\nlvoca9j.cmdline
Size 266B
SHA256 d3a85a24cc28649d01fb3297312f2f5b21c52ede9cd062677279c7dae8228bc1
MD5 c18d157c1303e329475ceee2861c9166
SHA1 99eb203418f1bc367f5cd482d9d9c607316c2deb
SHA512 dcab2a2bbedc8e80f6df9b4e444a9edb826b6e4234c477d340170c9e91106db3a0f8a22341dcddebe373f21eb54d7614954b4a50ca51574a1c79873fb5dbec53
MD5 SHA1 SHA512

Submit Download

tmp4391.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4391.tmp.exe
Size 78KB
SHA256 c6d5aa3c8ad29b89bd88511e877947885ea1b9a25fdcfbfaeab71aabea7e4b79
MD5 86563c6e34e5ee888e94652ed67a9cdc
SHA1 794c5b798eb52766004e681b2c3ad567d1a9e78a
SHA512 23ce3815130f04cbb8eebe2cc909f09d671fd28da05849abefcd8e1a9c5969c2fd3b3ce5282237710da08fa9c2995b674dc471168680404fe3dee792c85467f0
SSDEEP 1536:zPCHFo6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtT9/91cj:zPCHFonhASyRxvhTzXPvCbW2UT9/u
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc7EBA292844CD49019CC5515FE45FD86D.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc7EBA292844CD49019CC5515FE45FD86D.TMP
Size 660B
SHA256 cb23df79eca387665f68f037b42f4762b3d70d6e5139b89d745c3f4f95e21949
MD5 74e0a9372a8ad66e3d228feccdca0dd9
SHA1 014c5115320450754ec63bfa746b872f7b34497b
SHA512 e58a8e28e2411b17e659471b854ca58b18702877de2ca1864a346377922c794b195a3ac3ae877ee274ef3e64eb1337d2fecfa41ff62d748275a2a1d5293a691c
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2072-27-0x0000000074680000-0x0000000074C31000-memory.dmp

Download

memory/2072-26-0x0000000074680000-0x0000000074C31000-memory.dmp

Download

memory/2072-25-0x0000000074680000-0x0000000074C31000-memory.dmp

Download

memory/2072-23-0x0000000074680000-0x0000000074C31000-memory.dmp

Download

memory/4380-1-0x0000000074680000-0x0000000074C31000-memory.dmp

Download

memory/4380-22-0x0000000074680000-0x0000000074C31000-memory.dmp

Download

memory/4380-2-0x0000000074680000-0x0000000074C31000-memory.dmp

Download

memory/4380-0-0x0000000074682000-0x0000000074683000-memory.dmp

Download

memory/4728-18-0x0000000074680000-0x0000000074C31000-memory.dmp

Download

memory/4728-9-0x0000000074680000-0x0000000074C31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads