metamorpherrat | 8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe
Size 78KB
Sample240708-be1tgavdlp
SHA256 8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06
MD5 cdd4d0e5ec93d08299d2dc256aefd9f4
SHA1 1aca38fb9f927d09abc351951f1c690741328c9f
SHA512 ff1f3b2e6c9bc0124c45cf4a1d52e3a1ceb9d12fefaf8bcdc7ea6aeb1a306c368e7b31d46344212e3388c04d53885ae34a698a03a8f2db90895df9b7c9a6f772
SSDEEP 1536:rWV5jSAXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC669/C1DY:rWV5jS4SyRxvhTzXPvCbW2UC9/L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe

Deletes itself 1 IoCs

pid	Process
2920	tmp560F.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2920	tmp560F.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp560F.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe
Token: SeDebugPrivilege	2920	tmp560F.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4448	2504	8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe	81
PID 2504 wrote to memory of 4448	2504	8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe	81
PID 2504 wrote to memory of 4448	2504	8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe	81
PID 4448 wrote to memory of 1996	4448	vbc.exe	83
PID 4448 wrote to memory of 1996	4448	vbc.exe	83
PID 4448 wrote to memory of 1996	4448	vbc.exe	83
PID 2504 wrote to memory of 2920	2504	8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe	84
PID 2504 wrote to memory of 2920	2504	8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe	84
PID 2504 wrote to memory of 2920	2504	8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe	84

C:\Users\Admin\AppData\Local\Temp\8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe
"C:\Users\Admin\AppData\Local\Temp\8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lf4ykgop.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF6DEFE3218A940C0B4FDF89EDBF29C53.TMP"
    3⤵
    PID:1996
- C:\Users\Admin\AppData\Local\Temp\tmp560F.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp560F.tmp.exe" C:\Users\Admin\AppData\Local\Temp\8dadb765009d66cbef4360ddcedf3300e72ac0489b7c6773bc1b77949a9aeb06.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES56EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES56EA.tmp
Size 1KB
SHA256 50b881b60c054cad4201ccd9fffe14a1c1d1f9ff6870fa541ec509dc951ae5b5
MD5 2a6bfd65208773c3cdba9eea9cbbcdc1
SHA1 0f52136f553c33b650c6d69d1c4d2b4de6a45255
SHA512 1f3654e9f19ea5a42de7c8641ca64b67b4f82f043c8894450c5d730fffe43798ff458adabdadb0652387ee788eff1b1c342b7909066214debd05754b1c10883b
MD5 SHA1 SHA512

Submit Download

lf4ykgop.0.vb

Path C:\Users\Admin\AppData\Local\Temp\lf4ykgop.0.vb
Size 14KB
SHA256 9a2339d8d56305c61b5077956363923aaae1f5d0bcc67e48961c2cb8afc59492
MD5 3b5bb1794efe9b7d0d68920a62abede0
SHA1 85d19958525559edb01e655a369ec262af4adda0
SHA512 3ba660f69b05fd1ed316006b82121af51963de1d8b1bf9ff41ce6acaa3d97ad4efc13a3c5399e8766da684c738fe498f2e6335135558c24f0322990d76f8c2cd
SSDEEP 384:rBaNMfN0N/N3gckFzbN/NNbcHb4E6NUzN7QPSN7eP:dGMl0FQf3bcHQUhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

lf4ykgop.cmdline

Path C:\Users\Admin\AppData\Local\Temp\lf4ykgop.cmdline
Size 266B
SHA256 72d5c93c5acf29d23ba27d93530379f2f6508769ffab542829e644ae46ec5d89
MD5 b47dddd3a54c087fc8183f4c33049823
SHA1 2b16f00c4a054911acf4bb8e00db5974a0b344ce
SHA512 60815ab87fa4ca2c85f2752350fd5cb9d325e86b08559dbbd7f0c64de4c9e73ef00cf222c4d756ba2d0f867d3ce266d102f44435bdbd75a5bdbc7c89f9fda087
MD5 SHA1 SHA512

Submit Download

tmp560F.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp560F.tmp.exe
Size 78KB
SHA256 6b2e7ec1599c8c342d15e5dfeb713a06139adb8ee947b5875c9bab9f146b2344
MD5 1748ff5dd08c56334494e2e07d9aa4bb
SHA1 942cbcc7244c889fd849565419650e3638663585
SHA512 4477fee20f8874c01b278163aead021f5b6773f3a52a37c31b2b84920b0a90155cd06c94078e8625c9a1e34aa38bdc392f7e14a0620a2f38805e86b76079d51d
SSDEEP 1536:lPWtHF3M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtS9/J1Px:lPWtHF8hASyRxvhTzXPvCbW2US9/d
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcF6DEFE3218A940C0B4FDF89EDBF29C53.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcF6DEFE3218A940C0B4FDF89EDBF29C53.TMP
Size 660B
SHA256 1375faff3be4ac3f1a2db30c830275af6b324ed97ed3487d523f6150b9b737a1
MD5 de53db0b0cffe2b61f96b8980acee4b1
SHA1 f139d6301acd719c9f2cb7035a38543ef6e4ab24
SHA512 2c11c3af1792cf9a754466a3460719a83084ba7cc3ea80213b5f649a4c6ec58e6c6bccc677f4a6cc870ee45adb167f8b505690b8d5552e8f12ea925dd5b24738
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2504-2-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

memory/2504-0-0x0000000074B52000-0x0000000074B53000-memory.dmp

Download

memory/2504-1-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

memory/2504-22-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

memory/2920-23-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

memory/2920-24-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

memory/2920-26-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

memory/2920-27-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

memory/2920-28-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

memory/4448-13-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

memory/4448-18-0x0000000074B50000-0x0000000075101000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads