metamorpherrat | 4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe
Size 78KB
Sample240702-q9khasvgnf
SHA256 4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7
MD5 92bee31b67797490134a6a8bd217bd60
SHA1 fc7bb518f1509dbb9c81f8acf7432e2efcfdc5f1
SHA512 dec9f42c325bac5426c596c46353a73144dbf898873d8f3068be7d3197325880928591268aed84a1a888aa1c12bced9c08da18e6f05054f80a264e1e729f8eb7
SSDEEP 1536:6wV5HXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtm6t39/W1XZ:hV53SyRxvY3md+dWWZy99/a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe

Deletes itself 1 IoCs

pid	Process
4356	tmp4E4F.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4356	tmp4E4F.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\""	tmp4E4F.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe
Token: SeDebugPrivilege	4356	tmp4E4F.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1156	2848	4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe	81
PID 2848 wrote to memory of 1156	2848	4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe	81
PID 2848 wrote to memory of 1156	2848	4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe	81
PID 1156 wrote to memory of 320	1156	vbc.exe	83
PID 1156 wrote to memory of 320	1156	vbc.exe	83
PID 1156 wrote to memory of 320	1156	vbc.exe	83
PID 2848 wrote to memory of 4356	2848	4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe	84
PID 2848 wrote to memory of 4356	2848	4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe	84
PID 2848 wrote to memory of 4356	2848	4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1peqh_kl.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EFB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDCCCD85EA4444784B5047FD2A6F1447.TMP"
    3⤵
    PID:320
- C:\Users\Admin\AppData\Local\Temp\tmp4E4F.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4E4F.tmp.exe" C:\Users\Admin\AppData\Local\Temp\4c3c336254cd18bd9d357f61a256b03fbf52127e91d45c6681a67f46a3ced0e7_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1peqh_kl.0.vb

Path C:\Users\Admin\AppData\Local\Temp\1peqh_kl.0.vb
Size 14KB
SHA256 302d0bd4dd71e47b296fa0cd0b21542c584c741b3a111fbd15a3febbbec1c664
MD5 01d15bf986189551f6ddc7cadfd25a2a
SHA1 5517557bf2b3a40860bfbc65f5fa4ae0a9d9f16a
SHA512 effc60afce56718014b1454bf3bd20a5af667561b30af44aabe76e72fee9d08342bb04d35b4885ab86eee8184cef6e1c181e8652cd29f145046b40d4fdc474a2
SSDEEP 384:rqNuHPuNKK7NvNOKN4NUNOcHbzE6NGzN7QKSN7eP:Ss6/VBOUOcHzGhB+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

1peqh_kl.cmdline

Path C:\Users\Admin\AppData\Local\Temp\1peqh_kl.cmdline
Size 266B
SHA256 cfd19f40e8aa2a490eb46468cf9d74d05b97a41d83b8bc285e7329d2f3dcac07
MD5 43ba16f55bbf958c895df95a42016168
SHA1 aa40880488237c08c9e3228c4f7fd641666f6fb6
SHA512 740b241596f7621364d79d4b1cee15e9f9958f1cb2f4ddcc94436a22ddd089505b908a7aec43e771aa408739269b61bab0b31fd0d2f43ca6d27a3d2ce0d88a28
MD5 SHA1 SHA512

Submit Download

RES4EFB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4EFB.tmp
Size 1KB
SHA256 c0d1f19afdd7d49d50fef6211c4917204ca1bf126ee47defe059b125467e831f
MD5 689d5580202587b91e158692ab486151
SHA1 e2b86976b950c604407715bb6a8a9f168210de04
SHA512 1421f0b3e20e54807e7338b4434a2cc218711b49319fd40003e5786b93eb107a3c8e95c73b9cd527bc7d535a27d18852bc3a6af65109fbdfeaab0b4e7b22ab7d
MD5 SHA1 SHA512

Submit Download

tmp4E4F.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4E4F.tmp.exe
Size 78KB
SHA256 bb033a733faa8097dfac1adcc5105d2e14db2437e01348e3402026d6ca646e58
MD5 602dd406c4a6674e08e05e530f0dd55c
SHA1 239c943045a99732d3f9afc49dadcbd83362d01d
SHA512 fe816940665cb7131d07c0d8c67f1dd604aa7747b0bff868d5003955a4140061ca9648c8a96ad8758e692576a0f00a766314552375faf12a723658afdaaf586c
SSDEEP 1536:HRWtHHM3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQte59/q1KN:HRWtHs3xSyRxvY3md+dWWZye59/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcDCCCD85EA4444784B5047FD2A6F1447.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDCCCD85EA4444784B5047FD2A6F1447.TMP
Size 660B
SHA256 03a49ab25c890ce8049cacba3cbe75a9bcb4a26c561a7e568e3f78b0d6d930ec
MD5 d315652b4b81c9b8f9049d2f78982983
SHA1 7eb24774bd9efdfd61b903c2af8b5bad5879b208
SHA512 96510843f405d00ab486e449fe8e80db45794f042e0aecf72989b94b30152db3654b75dcc2a7369df85ebded8d549424a927ad63ff2c5a85cc3a5450239b4e98
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
MD5 4f0e8cf79edb6cd381474b21cabfdf4a
SHA1 7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4
SHA512 2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107
SSDEEP 1536:3XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtQ:nSyRxvY3md+dWWZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1156-18-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

memory/1156-8-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

memory/2848-0-0x0000000074D32000-0x0000000074D33000-memory.dmp

Download

memory/2848-2-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

memory/2848-1-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

memory/2848-22-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

memory/4356-23-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

memory/4356-24-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

memory/4356-26-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

memory/4356-27-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

memory/4356-28-0x0000000074D30000-0x00000000752E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads