metamorpherrat | 40f25d5d2ea7b8e72d867db4e517ba16107f58c9e94cb67b6689771d4e3eab0d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d67d7c0e9f1e099f03b137e5d611e1c0N.exe
Size 78KB
Sample240803-z2askavgrn
SHA256 40f25d5d2ea7b8e72d867db4e517ba16107f58c9e94cb67b6689771d4e3eab0d
MD5 d67d7c0e9f1e099f03b137e5d611e1c0
SHA1 50ecf6d2f689eb139bc4ada37e0fd381c689711d
SHA512 6b1e49a108831c8a34be9c44e4111c9e33aa872bbdcf5afe92c9dfe49ce4025b45209ff96356c95608ea929d713912dcd0bd087ee242b681d00d61c1ae042798
SSDEEP 1536:TcV5jSxAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6d9/u1W6:QV5jSxAtWDDILJLovbicqOq3o+nl9/2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2816	tmpB403.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe
2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmpB403.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d67d7c0e9f1e099f03b137e5d611e1c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB403.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe
Token: SeDebugPrivilege	2816	tmpB403.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2372	2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe	30
PID 2888 wrote to memory of 2372	2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe	30
PID 2888 wrote to memory of 2372	2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe	30
PID 2888 wrote to memory of 2372	2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe	30
PID 2372 wrote to memory of 2216	2372	vbc.exe	32
PID 2372 wrote to memory of 2216	2372	vbc.exe	32
PID 2372 wrote to memory of 2216	2372	vbc.exe	32
PID 2372 wrote to memory of 2216	2372	vbc.exe	32
PID 2888 wrote to memory of 2816	2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe	33
PID 2888 wrote to memory of 2816	2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe	33
PID 2888 wrote to memory of 2816	2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe	33
PID 2888 wrote to memory of 2816	2888	d67d7c0e9f1e099f03b137e5d611e1c0N.exe	33

C:\Users\Admin\AppData\Local\Temp\d67d7c0e9f1e099f03b137e5d611e1c0N.exe
"C:\Users\Admin\AppData\Local\Temp\d67d7c0e9f1e099f03b137e5d611e1c0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5yghntha.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB4CF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB4CE.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
- C:\Users\Admin\AppData\Local\Temp\tmpB403.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB403.tmp.exe" C:\Users\Admin\AppData\Local\Temp\d67d7c0e9f1e099f03b137e5d611e1c0N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5yghntha.0.vb

Path C:\Users\Admin\AppData\Local\Temp\5yghntha.0.vb
Size 14KB
SHA256 35abf51d57e0fdec8d8c53249380073e5cca5d127f15795aa60f26012a602325
MD5 247e0d6bfc59491c7f48f3f5175708b0
SHA1 8f251cbc56634293f0c3b73e4141b4c1446bafac
SHA512 798e40f07976eb45f533983865c1f981e66576759fbd0d52113fb7d1baf3c75c3c4a15278c3f188ba2629c6eab7ff0e7799a84fab298b9ae3e93aab2dc08c43e
SSDEEP 384:rMTNe0NONlNfOtoN+N8cHbufE6NyzN7QvSN7eP:sJiXjy8cHC7yhw+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

5yghntha.cmdline

Path C:\Users\Admin\AppData\Local\Temp\5yghntha.cmdline
Size 266B
SHA256 b842964e71245388ae407ef50be1c15c45e6c73a12635358bbc2eb45c6133711
MD5 fa7c8d89beba52f02e30fb789d874625
SHA1 38d997a12f81d25ddfdd4ab7ca111e68be5c54f9
SHA512 90dad0d510a90af381a4627dad9f8640ef61023d541377d7f03394be8f0169846b94d5a80022d109bc45acdeda63731e3c5620407a410fa125f047dd5fea0d53
MD5 SHA1 SHA512

Submit Download

RESB4CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB4CF.tmp
Size 1KB
SHA256 b0deb3022790a2b405068b1d379a00653cd61a367f0130e48e2d49e088e81d42
MD5 db03c2ba2ca2998ba6166e864d83b361
SHA1 35062308aaa8e3a325a0d3e2585896aa7237cd6e
SHA512 c32a2e06b917dfb0361f9f9ada7fb797ef4bfa497f0c5d08337f72e2c64b45429166ea2b662b704cef6d29eee1d97e509088989a4b9bd9ad493c294ab4851bed
MD5 SHA1 SHA512

Submit Download

tmpB403.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpB403.tmp.exe
Size 78KB
SHA256 7a4791d9a3eb0f94f03fddac274515f4160e10d93fd06adb0d7b53e434b964af
MD5 d7c9cc0eeede8ab7840ff970d14015eb
SHA1 16294a66a9e766559375a01be9cc8a2e242f1b4f
SHA512 6f104d94ed7d586da8225d4e40a9fa47c0feb8b19f1f90e3e7fd8f8ea175f1dae53ceda1eee5fc15f9dbda27d82f85b7b15ee1a450c203f5ea443f8fa2c4a41e
SSDEEP 1536:ahHFo6uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qtkq9/o6:6HFoI3ZAtWDDILJLovbicqOq3o+nkq9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcB4CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\vbcB4CE.tmp
Size 660B
SHA256 996fdc6a9f26651e187cfd71da42133f7cb68df7a96f332ed5eca5d09cfc6158
MD5 a49766b2ab77dcdc635c6f9d1e9897b5
SHA1 df45623c45e5c9da717f311545fdd320d6aecdd5
SHA512 4857387a76cf2ee1598272a9907a2e6f5cd38687267ac3f15df11b96e07b6952f46947a454bd1f5644a595e2f02fd489f53034d92359826e74a2b94b810285f9
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5
MD5 a26b0f78faa3881bb6307a944b096e91
SHA1 42b01830723bf07d14f3086fa83c4f74f5649368
SHA512 a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c
SSDEEP 1536:sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtQ:sAtWDDILJLovbicqOq3o+nQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2372-8-0x0000000074FC0000-0x000000007556B000-memory.dmp

Download

memory/2372-18-0x0000000074FC0000-0x000000007556B000-memory.dmp

Download

memory/2888-0-0x0000000074FC1000-0x0000000074FC2000-memory.dmp

Download

memory/2888-1-0x0000000074FC0000-0x000000007556B000-memory.dmp

Download

memory/2888-2-0x0000000074FC0000-0x000000007556B000-memory.dmp

Download

memory/2888-24-0x0000000074FC0000-0x000000007556B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads