metamorpherrat | 6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817

General

Target

6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe
Size

78KB
MD5

fac04255ae20a86fce9728aca8265b20
SHA1

8795f8c7f845319a981eeb2ffa42a380dee479ec
SHA256

6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817
SHA512

5320b1d1b2457efaa4c5725dabddacd5fdd6dae0f7b8e6fb3251669df56049b379a5b3f233c8e902ec483b419294efdd08d43d7d476b5fd52aaadc51b1cf756a
SSDEEP

1536:Xe5jSILT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6e9/YCGo1W:Xe5jSuE2EwR4uY41HyvYp9/YCGv

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Executes dropped EXE 1 IoCs

Processes:

tmp7A7D.tmp.exe

pid process

2052 tmp7A7D.tmp.exe

pid	process
2052	tmp7A7D.tmp.exe

Loads dropped DLL 2 IoCs

Processes:

6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe

pid	process
2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe
2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tmp7A7D.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp7A7D.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cvtres.exetmp7A7D.tmp.exe6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exevbc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7A7D.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exetmp7A7D.tmp.exe

description	pid	process
Token: SeDebugPrivilege	2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe
Token: SeDebugPrivilege	2052	tmp7A7D.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exevbc.exe

description	pid	process	target process
PID 2208 wrote to memory of 2716	2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe	vbc.exe
PID 2208 wrote to memory of 2716	2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe	vbc.exe
PID 2208 wrote to memory of 2716	2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe	vbc.exe
PID 2208 wrote to memory of 2716	2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe	vbc.exe
PID 2716 wrote to memory of 2764	2716	vbc.exe	cvtres.exe
PID 2716 wrote to memory of 2764	2716	vbc.exe	cvtres.exe
PID 2716 wrote to memory of 2764	2716	vbc.exe	cvtres.exe
PID 2716 wrote to memory of 2764	2716	vbc.exe	cvtres.exe
PID 2208 wrote to memory of 2052	2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe	tmp7A7D.tmp.exe
PID 2208 wrote to memory of 2052	2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe	tmp7A7D.tmp.exe
PID 2208 wrote to memory of 2052	2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe	tmp7A7D.tmp.exe
PID 2208 wrote to memory of 2052	2208	6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe	tmp7A7D.tmp.exe

C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe
"C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dt6nxfjx.cmdline"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B39.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B38.tmp"
3⤵
- System Location Discovery: System Language Discovery
PID:2764

C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6be3cdd0c096a9b0b5e1a16bac34abe731d3ceb3eb183b0dbad1707f21204817.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2052

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES7B39.tmp
Filesize
1KB

MD5
bc082d04feee11db99007ed0634c76d4

SHA1
0fb4c16ad0ca02f0f3f77871679bc9ad6de98a3a

SHA256
004864f20a778b317888d9c5361261ef19afaad861087e873d1465ca94802646

SHA512
adbfe6d571181acaf11fb313d2ac3047efbe603e4b64c16e6ace2ca15c9b068061a4a0de7175f92411d5525f10d5ec05efe06f46f6168d2ac82230131c51b3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\dt6nxfjx.0.vb
Filesize
14KB

MD5
c09d4d8cceb98fec26dce230353f0903

SHA1
2925e5eb68d8e5ab7535750601148249ce097209

SHA256
15d954c83e988e31ec442fe401acde005fc88a6818997bce4feb702e1b1ead02

SHA512
4f6980d5cfb0e9f4228569131cc2439a4a52b9be3b6e902a3bc30c371d04560bbf416d48b58569e661130124ac8081da896cb0454bd29cab5a2e6898bbe6d3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dt6nxfjx.cmdline
Filesize
266B

MD5
6342498c4dbb3b0de93458dd37896d55

SHA1
24c3393928c6fef0aaf3f60a3525fb3a6edd094d

SHA256
b7200b142db4aab8545797c9e9b48667c24decb4a030f00d228852192c203772

SHA512
5b663297b71cfe004c41c91db9a215028cf7d6489bf9563e6af3eb90fc4554d747b74f7af8e64d97b883c3d8e30d2472feda311f86a8c6788567e5ad779cc007

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7A7D.tmp.exe
Filesize
78KB

MD5
14ef97ee22682f9935f3f8a15e58387d

SHA1
5026666f079395071aaff5ec5cbd7ea7a397e7f3

SHA256
72dbf796e927ca8b035245adcb889c55d2c344a0f540a6a77cdac97cce29387f

SHA512
394e95938caa74e0f3c2bc1aa1a70d3099630080b480595bf59506186b3db4d5560e82d0fe5cf7646d8252514903bc0de182668b0b6d17cab0cf3bc20dd5cd42

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc7B38.tmp
Filesize
660B

MD5
00284579304422ee3fd5c3157a163c27

SHA1
cbe121699de2c38833a3504545624d8b8275826b

SHA256
0d3a2c5c3a8eda47ec3a34e2bc03ff62d376cda869ac8f95873dd94e5778087b

SHA512
832027f7f37daaa2a68b6f558aa4a87a1ce329bf405c3f9df907ffce77d55cb8580e35ee05c902af964db2de2278572d66586f30eae7e85f59e5a29eafd03708

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources
Filesize
62KB

MD5
6870a276e0bed6dd5394d178156ebad0

SHA1
9b6005e5771bb4afb93a8862b54fe77dc4d203ee

SHA256
69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

SHA512
3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

Download Submit
memory/2208-0-0x0000000074611000-0x0000000074612000-memory.dmp

Filesize
4KB

Download
memory/2208-1-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2208-2-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2208-24-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2716-8-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2716-18-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads