metamorpherrat | f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe
Size 78KB
Sample240629-fl79cavbkr
SHA256 f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a
MD5 5f1afc1948e124dc5a193b8401c140c0
SHA1 4ebf03bdeea074f797a06f1ea04d5d0ac2e90373
SHA512 6275a84ea39267fef489964d0ce3d6667a06d7620d9b9cd7545dc40bde79a5fa9b26b4a5280fb4fc564abe4c9ca8e557d42ad84dc4644d7a2c10b3bf2f60519f
SSDEEP 1536:6c58ddy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQty6Z9/t1Pd:6c58In7N041Qqhgx9/l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2744	tmp201E.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe
2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp201E.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe
Token: SeDebugPrivilege	2744	tmp201E.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2600	2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe	28
PID 2416 wrote to memory of 2600	2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe	28
PID 2416 wrote to memory of 2600	2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe	28
PID 2416 wrote to memory of 2600	2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe	28
PID 2600 wrote to memory of 2136	2600	vbc.exe	30
PID 2600 wrote to memory of 2136	2600	vbc.exe	30
PID 2600 wrote to memory of 2136	2600	vbc.exe	30
PID 2600 wrote to memory of 2136	2600	vbc.exe	30
PID 2416 wrote to memory of 2744	2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe	31
PID 2416 wrote to memory of 2744	2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe	31
PID 2416 wrote to memory of 2744	2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe	31
PID 2416 wrote to memory of 2744	2416	f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe	31

C:\Users\Admin\AppData\Local\Temp\f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe
"C:\Users\Admin\AppData\Local\Temp\f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ajivsddc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2176.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2175.tmp"
    3⤵
    PID:2136
- C:\Users\Admin\AppData\Local\Temp\tmp201E.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp201E.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f3b5be2340ed7b4b48c926acb80d71f62d510cc5565a47ef5d28233e14fb5b2a.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES2176.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2176.tmp
Size 1KB
SHA256 a91b95ee65b3bdfc49e89f2ac1b7cba01b1ac85b759b5eb73d2173a7335d6e92
MD5 527d26eaccde074265b56e078245e41c
SHA1 56b91be4877e3299d776e19dede91132ae758965
SHA512 80f4252f142e72d96bc617bf9c9dd92eba5b1ff3268b67f0139466e097b9ac741e7f7e667a708c6b4de7e01a947e5687765af4b12d8db5ccd653dde6673401d3
MD5 SHA1 SHA512

Submit Download

ajivsddc.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ajivsddc.0.vb
Size 14KB
SHA256 ff42e22b31c186aed88364ab5b16dea2bcf569b11995098fdb01d92492d9a45e
MD5 c185eb536a024802754b14f86cbdfbbd
SHA1 324a197b2dee83fd396b9d84c54176bc895472f8
SHA512 588742039c4ff379332412b51ac72332e2668d55d14516bae8a10fc4938c654f6fb727b69eda0fd0d9eed16cf9211557b6312af97bb36fd571573567575680fd
SSDEEP 384:r2N3NzbiNuN4VlnAOND8sNXZJcHb+E6NLzN7QZSN7eP:+9zbuCclAiD8sXZJcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajivsddc.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ajivsddc.cmdline
Size 266B
SHA256 b0e54c0bf87ce7a0e0211367c0d8a1a718d82eeb30fe84ab0872465887c2ba82
MD5 0af53c45fb21455b7707d0e09d8f1e40
SHA1 672107bc86a6ef55ff4e34ca0b71804e9af8bf18
SHA512 6cbbeb4c746698e8b60c826b736603e1c56222d39476abe87242f4e2fac070d7162781881d9dfaebac12d7cfc80e32f73719aff81e2080a271ec18f4a355c78b
MD5 SHA1 SHA512

Submit Download

tmp201E.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp201E.tmp.exe
Size 78KB
SHA256 8953f29185523ae4c8e7cd065694776a5979d3bf133765c51ef08601e837f85e
MD5 d8318fead305793e2f2574f937cbb4db
SHA1 05a9df6b4d5c56b34a56d611e183080c43a72c82
SHA512 6db514e1b52bfb412f7b670a5222fa9ddbfcd10145abc3b403038900f3b4cbbe32717247836a73608ff6e001495809b2888d84d0059d086d8beceee12791ac85
SSDEEP 1536:DHFo6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQte6G9/mY1e+:DHFo53Ln7N041Qqhge6G9/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc2175.tmp

Path C:\Users\Admin\AppData\Local\Temp\vbc2175.tmp
Size 660B
SHA256 a046c2da27423a40dcea3c79f14354fc61238fae1582ecc1ba9a95c489a0373d
MD5 6d1b857b80094ea0fff406e68e787b11
SHA1 99817608d042382f24c90af0a27ae428e7660834
SHA512 d50b70f5c86cc3fc2f9042d1e764d565c26fc3e176f445ebcbe43abe7e65382d8fc51e57f684b98a0d326089bc81d400813e399cec887c6b2242c046b911898d
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2416-0-0x0000000074421000-0x0000000074422000-memory.dmp

Download

memory/2416-1-0x0000000074420000-0x00000000749CB000-memory.dmp

Download

memory/2416-2-0x0000000074420000-0x00000000749CB000-memory.dmp

Download

memory/2416-24-0x0000000074420000-0x00000000749CB000-memory.dmp

Download

memory/2600-8-0x0000000074420000-0x00000000749CB000-memory.dmp

Download

memory/2600-18-0x0000000074420000-0x00000000749CB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads