metamorpherrat | ad9d971d6beb7f7618108d658c9ebfb5964018aba8141763e6997b4450da33fb

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fd11c398d52ac49f78ec56f0a8d78e0N.exe
Size 78KB
Sample240715-e22wts1aqd
SHA256 ad9d971d6beb7f7618108d658c9ebfb5964018aba8141763e6997b4450da33fb
MD5 7fd11c398d52ac49f78ec56f0a8d78e0
SHA1 2bd59b1fe4d664cca1d7fcd490ba1bcb9bc53422
SHA512 755ec21f064182aa5276373c39404b7323a83545a41b621b07efe8b36ed72af9f96f3bbd5446ead593ff0ea85033f56ad93ccd0357b08e77fef8e7453de3c26a
SSDEEP 1536:GsHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQth9/W1Ml:GsHY53Ln7N041Qqhgh9/f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	7fd11c398d52ac49f78ec56f0a8d78e0N.exe

Deletes itself 1 IoCs

pid	Process
1860	tmp8A00.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1860	tmp8A00.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp8A00.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	7fd11c398d52ac49f78ec56f0a8d78e0N.exe
Token: SeDebugPrivilege	1860	tmp8A00.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1756	2896	7fd11c398d52ac49f78ec56f0a8d78e0N.exe	85
PID 2896 wrote to memory of 1756	2896	7fd11c398d52ac49f78ec56f0a8d78e0N.exe	85
PID 2896 wrote to memory of 1756	2896	7fd11c398d52ac49f78ec56f0a8d78e0N.exe	85
PID 1756 wrote to memory of 4812	1756	vbc.exe	88
PID 1756 wrote to memory of 4812	1756	vbc.exe	88
PID 1756 wrote to memory of 4812	1756	vbc.exe	88
PID 2896 wrote to memory of 1860	2896	7fd11c398d52ac49f78ec56f0a8d78e0N.exe	89
PID 2896 wrote to memory of 1860	2896	7fd11c398d52ac49f78ec56f0a8d78e0N.exe	89
PID 2896 wrote to memory of 1860	2896	7fd11c398d52ac49f78ec56f0a8d78e0N.exe	89

C:\Users\Admin\AppData\Local\Temp\7fd11c398d52ac49f78ec56f0a8d78e0N.exe
"C:\Users\Admin\AppData\Local\Temp\7fd11c398d52ac49f78ec56f0a8d78e0N.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iuqkqfuy.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C32.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc55FF21FC66C24C0D90FF31C696A37621.TMP"
    3⤵
    PID:4812
- C:\Users\Admin\AppData\Local\Temp\tmp8A00.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8A00.tmp.exe" C:\Users\Admin\AppData\Local\Temp\7fd11c398d52ac49f78ec56f0a8d78e0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8C32.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8C32.tmp
Size 1KB
SHA256 742ee7cb764e4d5d2b9627b8043abad861ce031887a6f85feb2751c23a7d710b
MD5 4dc1a6ef5ab4dfc42bd8ae44494f817f
SHA1 0b8250cd1465bac79be76396a746a6ea37b24122
SHA512 ca268354296497161ee096244c91bc2ec88bef5626a75613a9ee8f3c594f600a5de5b29a1fdf933f2c6b3ab62cb36faf08f98361f87572387dacebd2a140f4ef
MD5 SHA1 SHA512

Submit Download

iuqkqfuy.0.vb

Path C:\Users\Admin\AppData\Local\Temp\iuqkqfuy.0.vb
Size 15KB
SHA256 3358d07f64c09cc011adc461f468a1245ae7e07c1842e7183819a53ec4f5f732
MD5 5fe1b0696dbc4ee74a103f39418b4e92
SHA1 9683b6754c0b48ba73ac3233765aaca75596fae7
SHA512 a4c89dcceec24b85a025db794ce9e517c562979353cf59b485effbb1d7383518d99779b72490ed5e954d7c9d99bd683cb5751927c46d7f200f2b9e0600306301
SSDEEP 384:rXNWEPNuZA+NiNf+/NvmN3cHbpE6NxzN7QmSN7eP:R71u+yu8C3cHRxhj+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

iuqkqfuy.cmdline

Path C:\Users\Admin\AppData\Local\Temp\iuqkqfuy.cmdline
Size 266B
SHA256 48b27c8dda63990c868226fb31b10df2febf352821f5140af393f7ac88035375
MD5 1baa6f6acf9c2deb0ae951298d6dbfda
SHA1 1305e4ce9a8dea3ccbd3e2cc8971bb1d6c1a6822
SHA512 50a8288268fa8064f8fff26f5390a1e1d14d70bf65d42c8574aa0659137fd60fbbdc8126ede5212f37300b23cb1fa43dd40d5af25bb7c7db30b6f74cd0b96cc9
MD5 SHA1 SHA512

Submit Download

tmp8A00.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp8A00.tmp.exe
Size 78KB
SHA256 ce313f8ac7bda676397ccb4cbfc0929614a1a11409f7c5bf652b2e1b83519b90
MD5 1182ced2d3c4e0e69714500c8f7a0b83
SHA1 1f14df58ff4c093928acff860ed68e4edb9f8563
SHA512 1a1b01885f2ebf81e62f6d54eb5d58b88024811fefa4d673c4a1d29346de804158770dc5f39e7b69863a3dc8e070b09bda33c185e71a8837c49e859b01338a3e
SSDEEP 1536:cy5j5dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6k9/sJ1vq:cy5jkn7N041Qqhg89/1
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc55FF21FC66C24C0D90FF31C696A37621.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc55FF21FC66C24C0D90FF31C696A37621.TMP
Size 660B
SHA256 0a1b416670b71279f659bf0992f16cf206d626375ae324f8611b64fd41efdb56
MD5 c44115593c8f8d1124a5f9df589427f1
SHA1 54b45a32dbb6af9a68c2f42482aefe1dc5e4b96f
SHA512 c577a2b33750b17230424d59fc6514b6909eeef1f811c4b0055e7e29a499afe0d4364e3ee42edd6f9455a26f8f71596ca02f254150ce8d19347e0e7ac1ebe149
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1756-8-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/1756-18-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/1860-23-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/1860-24-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/1860-26-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/1860-27-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/1860-28-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/2896-0-0x0000000074B82000-0x0000000074B83000-memory.dmp

Download

memory/2896-2-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/2896-1-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

memory/2896-22-0x0000000074B80000-0x0000000075131000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads