metamorpherrat | 2b4edbd97dfbaccc7d82e2e19149088172f5a6f46da5ae30e15a6574b0afcc5f

General

Target

9a4b57bb2ade93773070d3f4c171f970N.exe
Size

78KB
MD5

9a4b57bb2ade93773070d3f4c171f970
SHA1

bd0fc2558c9e830805c98c4ef11b44fb330c9c03
SHA256

2b4edbd97dfbaccc7d82e2e19149088172f5a6f46da5ae30e15a6574b0afcc5f
SHA512

15f0f4aa876a5e1241437a9d7bca329c675575ae56f47be136f692778481896974594e128529548f141e270f515e9f3933b95bf53015c03e6cbeafb2a3bf36db
SSDEEP

1536:K58Tdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN6u9//1hH:K58yn7N041Qqhg99/T

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9a4b57bb2ade93773070d3f4c171f970N.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	9a4b57bb2ade93773070d3f4c171f970N.exe

Executes dropped EXE 1 IoCs

Processes:

tmpA690.tmp.exe

pid process

2288 tmpA690.tmp.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
2288	tmpA690.tmp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tmpA690.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmpA690.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9a4b57bb2ade93773070d3f4c171f970N.exevbc.execvtres.exetmpA690.tmp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a4b57bb2ade93773070d3f4c171f970N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA690.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9a4b57bb2ade93773070d3f4c171f970N.exetmpA690.tmp.exe

description pid process

Token: SeDebugPrivilege 3952 9a4b57bb2ade93773070d3f4c171f970N.exe
Token: SeDebugPrivilege 2288 tmpA690.tmp.exe

description	pid	process
Token: SeDebugPrivilege	3952	9a4b57bb2ade93773070d3f4c171f970N.exe
Token: SeDebugPrivilege	2288	tmpA690.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9a4b57bb2ade93773070d3f4c171f970N.exevbc.exe

description	pid	process	target process
PID 3952 wrote to memory of 1804	3952	9a4b57bb2ade93773070d3f4c171f970N.exe	vbc.exe
PID 3952 wrote to memory of 1804	3952	9a4b57bb2ade93773070d3f4c171f970N.exe	vbc.exe
PID 3952 wrote to memory of 1804	3952	9a4b57bb2ade93773070d3f4c171f970N.exe	vbc.exe
PID 1804 wrote to memory of 2028	1804	vbc.exe	cvtres.exe
PID 1804 wrote to memory of 2028	1804	vbc.exe	cvtres.exe
PID 1804 wrote to memory of 2028	1804	vbc.exe	cvtres.exe
PID 3952 wrote to memory of 2288	3952	9a4b57bb2ade93773070d3f4c171f970N.exe	tmpA690.tmp.exe
PID 3952 wrote to memory of 2288	3952	9a4b57bb2ade93773070d3f4c171f970N.exe	tmpA690.tmp.exe
PID 3952 wrote to memory of 2288	3952	9a4b57bb2ade93773070d3f4c171f970N.exe	tmpA690.tmp.exe

C:\Users\Admin\AppData\Local\Temp\9a4b57bb2ade93773070d3f4c171f970N.exe
"C:\Users\Admin\AppData\Local\Temp\9a4b57bb2ade93773070d3f4c171f970N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k37ia8ts.cmdline"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADD4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2BCA5D62400846F6A6DE9E12F47BAEE.TMP"
3⤵
- System Location Discovery: System Language Discovery
PID:2028

C:\Users\Admin\AppData\Local\Temp\tmpA690.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpA690.tmp.exe" C:\Users\Admin\AppData\Local\Temp\9a4b57bb2ade93773070d3f4c171f970N.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2288

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESADD4.tmp
Filesize
1KB

MD5
a89c0d4f7dfe41d6e26c23262e8975e6

SHA1
45b7a4ae83b0de904a823732dc2db6f99670d8bf

SHA256
83f9a98e8b9b1608eb1e982ae690a334a5b7bf373bb188b52eed0248c9252423

SHA512
6f8af395168ba3bf9ae39347833873c471aaed5bbc1e3f218caead2e9c1b5c71cafc0fbd95c556faa2dd363a201287fdbda9f0adfe0023e91f7166eec4fb01c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\k37ia8ts.0.vb
Filesize
14KB

MD5
8603d868a2934a6f3b0f4f18dbf3c47e

SHA1
670f140dbff62f493f7306cf581fbb0283da1674

SHA256
71128e732891f87e038fbe8670c669d0510f8b683099f12206fbe2a402d36f06

SHA512
5b635738f3cd12c3d58dd1fdf97e2c6a870f7233380e39c2704fbcac0d4960fc9f041e5c913b7b84380e94e12b28dff1061d193734561fece5cb40b58e54d459

Download Submit
C:\Users\Admin\AppData\Local\Temp\k37ia8ts.cmdline
Filesize
266B

MD5
af33933c263078d97763a8a57d75892a

SHA1
0d6040e8413feb7785e230ebfd31adcb70c73dbf

SHA256
835ddc44c6476455c546f3fed7d38cdbc403620855b004775268c474433c393c

SHA512
41cef66dfbba0ab64dfe423c72735e97238590a99a4734794018414b7738b91fec12b1562db11e14677533ec7ad7e09c40e47a4c7a6ed07d2159d6921f79469d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA690.tmp.exe
Filesize
78KB

MD5
18d29dadd9e13a1e91e0757dd0bffdf3

SHA1
de2e86e1885d84f72fafc2c5ea07a120297f5c4e

SHA256
880958e6bf49b3dd0014dfc16ba6d8508e0b1be3aa0ae8fe41abcd8dca18ebab

SHA512
109e4a9d762cb509faabbcdbc39bd12c4273fc1ff4c2db71c5764ca4bb01481357170da14ed598815365864c43f0c7b9f8243e6c48961cc03630393e3c55865c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc2BCA5D62400846F6A6DE9E12F47BAEE.TMP
Filesize
660B

MD5
a85c69d88e5e5bfcf115276e930c4e71

SHA1
edcd730dad173798ce8f02f0da28801f83787b8f

SHA256
3c9f8b3ab5bd54f95c1be1b5c95c674d11bbf2894b08728152c9a9ae8a9f50e5

SHA512
581a9d03e5348160f4b3ff9f86523dddd90f60ab299636ccd51d72ed577dcb390ba2981c3530a3cdcf234df6c81160306be7ab21eadc988d015198474d3bce2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources
Filesize
62KB

MD5
aa4bdac8c4e0538ec2bb4b7574c94192

SHA1
ef76d834232b67b27ebd75708922adea97aeacce

SHA256
d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

SHA512
0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

Download Submit
memory/1804-8-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/1804-18-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/2288-24-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/2288-23-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/2288-25-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/2288-27-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/2288-28-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/2288-29-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/3952-0-0x00000000749D2000-0x00000000749D3000-memory.dmp

Filesize
4KB

Download
memory/3952-2-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/3952-1-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download
memory/3952-22-0x00000000749D0000-0x0000000074F81000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads