metamorpherrat | 023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31/07/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe
Size 78KB
Sample240731-wtk2sa1flg
SHA256 023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9
MD5 c3caa24b825c186bf456800defb14844
SHA1 72620bc3e40633154cee6dcbfcd829f7adc80960
SHA512 18420a507a8c9731946c8ffa620977e8a30dbb882db41e4ed12fbd67802c31d8399f21719ceabd01dcaf7f8b0901442ff94e0721e1af2adc4b44bdd2ee8759d4
SSDEEP 1536:8V5jSAXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtN6Q9/Y1tk:8V5jS4SyRxvhTzXPvCbW2U/9//
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe

Executes dropped EXE 1 IoCs

pid	Process
4896	tmp9114.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp9114.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9114.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe
Token: SeDebugPrivilege	4896	tmp9114.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3136	632	023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe	86
PID 632 wrote to memory of 3136	632	023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe	86
PID 632 wrote to memory of 3136	632	023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe	86
PID 3136 wrote to memory of 2064	3136	vbc.exe	88
PID 3136 wrote to memory of 2064	3136	vbc.exe	88
PID 3136 wrote to memory of 2064	3136	vbc.exe	88
PID 632 wrote to memory of 4896	632	023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe	89
PID 632 wrote to memory of 4896	632	023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe	89
PID 632 wrote to memory of 4896	632	023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe	89

C:\Users\Admin\AppData\Local\Temp\023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe
"C:\Users\Admin\AppData\Local\Temp\023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bjh9yzgb.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9337.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2D0BEBDD79FE4F58B2E34140FF3BD9FA.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2064
- C:\Users\Admin\AppData\Local\Temp\tmp9114.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9114.tmp.exe" C:\Users\Admin\AppData\Local\Temp\023333ffd6509a706996c5a987f9da00f164abea10cb5d9dc90ae414a40042f9.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9337.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9337.tmp
Size 1KB
SHA256 a8a9879e4a56b0b82a743e5c52991469efb25c12b67d3a0284aaae885b3106f3
MD5 6885379b3ceb744b3dacf019632c2240
SHA1 bf82ca9e60b4017235b03edbe493af96bd9c2820
SHA512 995dedc3435652a0563edfe7883fb81536e6fcd620bb3a115949b402e90fd761cecaf78dae9b3765bf028e21cf0a63656245d789fe883433860e1ee80b1bdbb8
MD5 SHA1 SHA512

Submit Download

bjh9yzgb.0.vb

Path C:\Users\Admin\AppData\Local\Temp\bjh9yzgb.0.vb
Size 14KB
SHA256 b284f94f3f7304eee5ef684a3d909f8fa7d4072a49ba148f36ba7250f9d6b98d
MD5 20a1ca56a0e4e31c2bea9d8d7e6348f4
SHA1 1ecc05fc9d2b1317b29abbdf7500b50668aff195
SHA512 8e836780883388664bac1ba30cfb6035c783229b354e4f34834f2705fc680a6555675a13eb2952dd4db9cfc76e820a058d153ce17bbb5d5fc3f0e5cba0aeccc2
SSDEEP 384:rBKNsjNrNuN8gckFzwNXCNEcHb4E6NUzN7QPSN7eP:dWSZCrG+EcHQUhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

bjh9yzgb.cmdline

Path C:\Users\Admin\AppData\Local\Temp\bjh9yzgb.cmdline
Size 266B
SHA256 88d6cab046662b3f1651f8c29fc3abc5fda96bfc5e90d71fa49c8202f12635b2
MD5 f8b032219c9e80da7823d459304cb34d
SHA1 ec0d92f934eb302b65ca51d36de166b1bd63058d
SHA512 f88a94adff874ba731563f36f051fa487d67e60ef241ccf2d4ee137f8695a55515713f385c959e790ac7cbebfa4c3f11056b9c5d2f4c31bb1d25b00437ac14d2
MD5 SHA1 SHA512

Submit Download

tmp9114.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp9114.tmp.exe
Size 78KB
SHA256 0ecbf9f8ea2a44f4505def333d0a100330506e8bc034116b431a57aa21b70ab7
MD5 17de228c7dd6e83125b9e542e4227cc7
SHA1 7c1ccf453a7f4f2c0c8f49706bef80f9f417503f
SHA512 917a319aed646bab747267d7deb14ff82720c606fa52c38a50164e4b235535cda37e497ecf170e5f7aab9809eb88b64cc536e6d2214be1f836d2299f1e9628ef
SSDEEP 1536:juHHM7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQteg9/m1nB:juHshASyRxvhTzXPvCbW2Ueg9/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc2D0BEBDD79FE4F58B2E34140FF3BD9FA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc2D0BEBDD79FE4F58B2E34140FF3BD9FA.TMP
Size 660B
SHA256 75f5dfc6e8daac3edf4a44360e7622bfdeaebb35ab0ea5f52b90f248a67cf6e0
MD5 09182c2b6b72d74f9cc6b93d177f4f24
SHA1 9106ce2f37491d9a05ea25b59b9009d3f5fa716b
SHA512 3d32e0631bb906578ee47b66322a6154a38cf47f875dda75c195a7e4a3bb44a14a352ec5c61ff3be8a143acc4064b261e7d94d8888292d9fc0505aaae49a9054
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/632-1-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/632-0-0x0000000074DC2000-0x0000000074DC3000-memory.dmp

Download

memory/632-2-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/632-22-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/3136-9-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/3136-18-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/4896-23-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/4896-24-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/4896-26-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/4896-27-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/4896-28-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads