metamorpherrat | f458448d405a41c8075cd24c8f5aaed869db692f8ec60ad9a1e21dd8f9501e5b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe
Size 78KB
Sample240703-cts8lswhnn
SHA256 f458448d405a41c8075cd24c8f5aaed869db692f8ec60ad9a1e21dd8f9501e5b
MD5 20c1ca433d6b53e4bfdfae2fffb52a2c
SHA1 647787803633f6b6c207a9ff355654c0517b7e67
SHA512 9b996bc1970489dc3c144ecc53aec67497b393a738f761cfa4624ad1265615ba7b14aed181ec08a485758e51c0230190a170a4d40c45181c797da135b8e5cf9e
SSDEEP 1536:HhRWV5jLXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt96p9/eXo1RE:BRWV5jLSyRxvY3md+dWWZye9/O3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
116	tmp56EA.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\""	tmp56EA.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe
Token: SeDebugPrivilege	116	tmp56EA.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 968	1572	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	81
PID 1572 wrote to memory of 968	1572	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	81
PID 1572 wrote to memory of 968	1572	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	81
PID 968 wrote to memory of 2356	968	vbc.exe	83
PID 968 wrote to memory of 2356	968	vbc.exe	83
PID 968 wrote to memory of 2356	968	vbc.exe	83
PID 1572 wrote to memory of 116	1572	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	84
PID 1572 wrote to memory of 116	1572	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	84
PID 1572 wrote to memory of 116	1572	20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7lduscwf.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57F3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7DB46DC35894FDCA9A3B6B625624CA.TMP"
    3⤵
    PID:2356
- C:\Users\Admin\AppData\Local\Temp\tmp56EA.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp56EA.tmp.exe" C:\Users\Admin\AppData\Local\Temp\20c1ca433d6b53e4bfdfae2fffb52a2c_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7lduscwf.0.vb

Path C:\Users\Admin\AppData\Local\Temp\7lduscwf.0.vb
Size 14KB
SHA256 5bd97cb472001f4193eff55601fd13cf3eaa4200a0e06aaa1fbe137285a4e2c6
MD5 3d530d336aebecfbd1923d0dee667a64
SHA1 599129f83e0d6075ebb67ceaeb32d13ac0899271
SHA512 dc692297c20167bdc5ac2b32bf534eac5f6a22a6e6633fd968c5fb48449c9ef5e2b5042b1e8c38b6c73762de5fdc65edb28ba05d8efa66db7873c7c5f78c424c
SSDEEP 384:raN1/NAq5vZN1NjKNrHNkdNtcHbzE6NGzN7QKSN7eP:iXJzH25tkPtcHzGhB+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

7lduscwf.cmdline

Path C:\Users\Admin\AppData\Local\Temp\7lduscwf.cmdline
Size 266B
SHA256 e334466975430e0f806530f75dd595b4f4879f9ef3ae9756ecdfacc191e05c3c
MD5 691428aaa23b24633b1789235ffc2120
SHA1 8ca75fb4b348ded03a8cf82b9aa60a31b519472d
SHA512 24f17e24d294b322cb60550ce62ce60a796b29c63622c745ded81b58487f63f6a246a37dc2c5ba4a500b8de28c31b8c9dc874742eab208f3d42c247e0f28a682
MD5 SHA1 SHA512

Submit Download

RES57F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES57F3.tmp
Size 1KB
SHA256 c422ee6b25bdccc48d63a1499594e9dea6efdcf317137fb4ddad518d056c0caf
MD5 c25b2adbda3f4ac88585b2ab8d63c7a0
SHA1 5d6b381e47e55c6e209521af080c56a9d37f8ae5
SHA512 d758a6c62495d7451f6d3f3db5a6302b806c9decdd0a04469712e65b43ec5ef6c596b6ae96a61d5630e908bae5c092a74a87bd2c426461ae10c9fa93fe7afc30
MD5 SHA1 SHA512

Submit Download

tmp56EA.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp56EA.tmp.exe
Size 78KB
SHA256 b59ed67e3cc566d19550b217b77ccff8dc621e36526b6791afb0cf6270bd74b0
MD5 78bcf9059ab5b2397fb2048719948dbd
SHA1 0a65a5149269e004a6cbd36936cd1178c22e29d9
SHA512 5ce662167145589aaa6622761beb55b7aaf4fdb8c7b27a1dba43bc736a806c32501b3abf4f8eb0f351bd170d2ecb065deff7ace4738bd499b5e200729c5c69cb
SSDEEP 1536:mRWtHY6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtej9/o18B:mRWtHYn3xSyRxvY3md+dWWZyej9/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc7DB46DC35894FDCA9A3B6B625624CA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc7DB46DC35894FDCA9A3B6B625624CA.TMP
Size 660B
SHA256 27829cbe96458d5a920dce255c20d5478d7b4222d8e19c0e8e31e52e444b80ce
MD5 f93b92d0e7a1b0acb8aedcba4b899e76
SHA1 49f2807c9ef3c0d203f1ba11bc1e192e9ddf34d8
SHA512 b7bd4b3ff803787e077b8f4422263898c15e0d34cb03c70415b159f537dfa0b33d46a45d597ee1511bf2619d84ee1cc03dbe092f2fde781367340ff4e5fb2555
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
MD5 4f0e8cf79edb6cd381474b21cabfdf4a
SHA1 7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4
SHA512 2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107
SSDEEP 1536:3XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtQ:nSyRxvY3md+dWWZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/116-23-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/116-28-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/116-27-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/116-26-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/116-24-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/968-18-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/968-9-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/1572-22-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/1572-2-0x0000000075050000-0x0000000075601000-memory.dmp

Download

memory/1572-0-0x0000000075052000-0x0000000075053000-memory.dmp

Download

memory/1572-1-0x0000000075050000-0x0000000075601000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads