metamorpherrat | 21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe
Size 78KB
Sample240706-x94dqstdpd
SHA256 21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca
MD5 e0a1f6e620c7a54da76ac0dcfefeaff7
SHA1 0ae77a558dd7298cc72eff664880e1da94bd211a
SHA512 c85cd1a1a6f1d6d72246d252ad65253898a863c3d711b1157db683ef7716a8add64ec6304810825c6406dfddf88ce420d42f0de75c3c8fec2bf923746e2389c9
SSDEEP 1536:NPCHY6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt09/t1US:NPCHYn3xSyRxvY3md+dWWZy09/v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe

Deletes itself 1 IoCs

pid	Process
3680	tmp8E26.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3680	tmp8E26.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\""	tmp8E26.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe
Token: SeDebugPrivilege	3680	tmp8E26.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 5088	4560	21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe	84
PID 4560 wrote to memory of 5088	4560	21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe	84
PID 4560 wrote to memory of 5088	4560	21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe	84
PID 5088 wrote to memory of 980	5088	vbc.exe	87
PID 5088 wrote to memory of 980	5088	vbc.exe	87
PID 5088 wrote to memory of 980	5088	vbc.exe	87
PID 4560 wrote to memory of 3680	4560	21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe	88
PID 4560 wrote to memory of 3680	4560	21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe	88
PID 4560 wrote to memory of 3680	4560	21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe	88

C:\Users\Admin\AppData\Local\Temp\21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe
"C:\Users\Admin\AppData\Local\Temp\21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ic49wnee.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F4F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAB6E879B6CEB4FB1A4F3BF5FB8B7A3E8.TMP"
    3⤵
    PID:980
- C:\Users\Admin\AppData\Local\Temp\tmp8E26.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8E26.tmp.exe" C:\Users\Admin\AppData\Local\Temp\21d2a1a105d1732a7455269f4d82c45957fab4745744dab6c58fd7a20fac0fca.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8F4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8F4F.tmp
Size 1KB
SHA256 05dd30ae8b4526a06c03a84eb2ba001b5debdf07016d0b6e160d577ec85190ad
MD5 be19f34d2b0eb28449becc13f6b54d12
SHA1 cc3b98ae0524ab327d51f786b5c055f5cab3d87d
SHA512 fc79ced8e45a9eb966f7a17ccba4155a3ad63d58e1d0bc4f58c00db434724232650d611e80bebce82bcb78778cbb12937b704d7cd926b724663ab51855c100e1
MD5 SHA1 SHA512

Submit Download

ic49wnee.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ic49wnee.0.vb
Size 15KB
SHA256 a62943cddb8f9e7238341aa867c40da1395355007c572d5d81aaac68230fc59c
MD5 0a3e78fd18d158cc89486c47d9a8a628
SHA1 da677d151878320234a669d70fb1947a6a5fb742
SHA512 35e8726f0053278999e5973827721c8933f1372ce56113096d0e61b6ecc48f4bf5e14cbe256caed475f23f84c7cfe93e91fdb55d58287e1b44bfd56e1a352dd0
SSDEEP 384:rzNsuNUuNfLNCpPNaNaOjcHbJE6NOzN7QnSN7eP:lsCUChEGxcHhOhW+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

ic49wnee.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ic49wnee.cmdline
Size 266B
SHA256 ce6ce2b2b7ccc3a307fb391e8e50d4f39c6eeead9b64e081185fd18099b39f53
MD5 7e271d083504145b00546cf9c44c12e5
SHA1 9b944a2686d5f2fe2513055362b0ce090773cf34
SHA512 0ed22683e27693579b103c7d48e4bbe50edf31dcf18823153b89f639f3ee484c8b295d85665875fe24e6bc0ddcb0c44943e63b3493de0d6e6df5f21cf8891a09
MD5 SHA1 SHA512

Submit Download

tmp8E26.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp8E26.tmp.exe
Size 78KB
SHA256 e3f76c5baf9d83688e63462e0541fab2cc3acf18328c9e883afbd1f5bc94db49
MD5 371cefcfebb9144a6cf5dece071c3281
SHA1 a8a78c2a39053585917aab2ea8e601eab21f9ed3
SHA512 564a05191d86beaf91192af828b9f392b50d8dab72eba7d589c9a896ac35cf3d676506ecbaf6dd06b6a4bc0f2f8c1eb2a87b5a87e6c1a8c369fcf009c58f5e6b
SSDEEP 1536:t5jSRXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtC6z9/D1RO:t5jSRSyRxvY3md+dWWZyb9/2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcAB6E879B6CEB4FB1A4F3BF5FB8B7A3E8.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcAB6E879B6CEB4FB1A4F3BF5FB8B7A3E8.TMP
Size 660B
SHA256 d7b1b506cc6912272f2484f6a795b96c4ee53bbf6c5478334a64fed88d801e36
MD5 afb94cb5cf57173040ee7b4e6acaeb5f
SHA1 596eefc584247d0a0a03bf6a8017e0251af17bb8
SHA512 830f8743cc7aa09adfdf302bedc55d60142b724a36a675a97634fe8df24f16459206a9ae5fb8757b5d0fe8c7e2ec550a15b5897977e2983018851bb075c4ff1e
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
MD5 4f0e8cf79edb6cd381474b21cabfdf4a
SHA1 7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4
SHA512 2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107
SSDEEP 1536:3XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtQ:nSyRxvY3md+dWWZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3680-28-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

memory/3680-27-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

memory/3680-26-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

memory/3680-24-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

memory/3680-23-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

memory/4560-22-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

memory/4560-1-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

memory/4560-2-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

memory/4560-0-0x00000000751E2000-0x00000000751E3000-memory.dmp

Download

memory/5088-18-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

memory/5088-9-0x00000000751E0000-0x0000000075791000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads