metamorpherrat | f30c91f9f1507ed81cbbd900b2162a813e114cc152ef4ee513d3abcd221427d1

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2024, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f22636bfbaf78a0ede095307e2849de0N.exe
Size 78KB
Sample240804-ssprssybjp
SHA256 f30c91f9f1507ed81cbbd900b2162a813e114cc152ef4ee513d3abcd221427d1
MD5 f22636bfbaf78a0ede095307e2849de0
SHA1 359529e2ec8ab551a245bad2687a03ddea27082d
SHA512 011614e69968460f8dc83b606d2783da46501330da5329eac8270c500ca338f77b25bb12cb9344c0ec557f5fafd656dd397d5e1917cc2ad1df2ce44f8ef5c857
SSDEEP 1536:2tHHM7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt/B9/9+1ZD:2tHshASyRxvhTzXPvCbW2U/B9/I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	f22636bfbaf78a0ede095307e2849de0N.exe

Deletes itself 1 IoCs

pid	Process
4792	tmp8C90.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4792	tmp8C90.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp8C90.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f22636bfbaf78a0ede095307e2849de0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8C90.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	f22636bfbaf78a0ede095307e2849de0N.exe
Token: SeDebugPrivilege	4792	tmp8C90.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 5016	3740	f22636bfbaf78a0ede095307e2849de0N.exe	86
PID 3740 wrote to memory of 5016	3740	f22636bfbaf78a0ede095307e2849de0N.exe	86
PID 3740 wrote to memory of 5016	3740	f22636bfbaf78a0ede095307e2849de0N.exe	86
PID 5016 wrote to memory of 3056	5016	vbc.exe	88
PID 5016 wrote to memory of 3056	5016	vbc.exe	88
PID 5016 wrote to memory of 3056	5016	vbc.exe	88
PID 3740 wrote to memory of 4792	3740	f22636bfbaf78a0ede095307e2849de0N.exe	89
PID 3740 wrote to memory of 4792	3740	f22636bfbaf78a0ede095307e2849de0N.exe	89
PID 3740 wrote to memory of 4792	3740	f22636bfbaf78a0ede095307e2849de0N.exe	89

C:\Users\Admin\AppData\Local\Temp\f22636bfbaf78a0ede095307e2849de0N.exe
"C:\Users\Admin\AppData\Local\Temp\f22636bfbaf78a0ede095307e2849de0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\opuq6ljk.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D5B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE3B5A02C393F443DA562DD159DD8D1F.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3056
- C:\Users\Admin\AppData\Local\Temp\tmp8C90.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8C90.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f22636bfbaf78a0ede095307e2849de0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8D5B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8D5B.tmp
Size 1KB
SHA256 b63e6534db70e29a59644f7227dd6d920b42c18e91caa4984532dd40e53ba150
MD5 8f47209fac81f6c142a448a283e822cc
SHA1 dbd4f09dd11d9582e7673c9dcb0759801d16683e
SHA512 94031b87e87d5b277b08b2f68dda88fcbe386119539a1b78be12070f1acced7ba9c86b301ce067e1227992f8f582a036f88ce12a8ecad130959a1e73b6df77d7
MD5 SHA1 SHA512

Submit Download

opuq6ljk.0.vb

Path C:\Users\Admin\AppData\Local\Temp\opuq6ljk.0.vb
Size 15KB
SHA256 57fbe4a340964c8ac7dd837234413374f9e9322b5e748ce4951392847a52396a
MD5 33e51ac005068938506d8d68d5ce6310
SHA1 e3a76f1589460d033da97bd0b43d881cf9d21e81
SHA512 57f5b7b4fab6a1c0df4a5ad20f568321f7871dca159de405493539307aeac1a1a0743c3d9e20a08124298523752992b01f1239403ac3ef31d55fca2bc61746cf
SSDEEP 384:rW7NfDNVuNON/MPNWN+cHbXE6NnzN7QhSN7eP:0JVCimK+cHXnhM+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

opuq6ljk.cmdline

Path C:\Users\Admin\AppData\Local\Temp\opuq6ljk.cmdline
Size 266B
SHA256 25d08d949443d27f193c5ada95a5c1d140d9da50d8187585274f26859a75190b
MD5 5ad4e1a1e41cab04f74891a087779b40
SHA1 985811973075a928b2c3e0e2a76ac414ea3c0b95
SHA512 f48b88d96812c4d1e9ff54f9f0a520966ce21a67006ff18be464a3f194f1703a355a6b31c8144d1e676a618dd8ba47a0566e1833a95a1eadf7a5d3c03515fee5
MD5 SHA1 SHA512

Submit Download

tmp8C90.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp8C90.tmp.exe
Size 78KB
SHA256 3d3bea7fda3385832896afcddd30da96d6f6317ff9df4ebccf926ba9273469c6
MD5 967ef269fdcdbb80075884ceaabcaf3d
SHA1 382f1331e5aaf02bca9a03e11d904b253a0c02bc
SHA512 1ad6be9d17f1b08e7c68a2f01e982519369bb2eaee085cbe9f8f19db8497a76f78af18703647b9ee6183472274616aaeaa82502e9448eb26f5c9aabcdd62ff93
SSDEEP 1536:oPy5jSBXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6/9/r1Cj:oPy5jSBSyRxvhTzXPvCbW2U39/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcE3B5A02C393F443DA562DD159DD8D1F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcE3B5A02C393F443DA562DD159DD8D1F.TMP
Size 660B
SHA256 83bb938ea0d01d87f86ffd06addac2a69341dd2c1eb71751baadc31cefaf0a37
MD5 93ea8dd0e81b81f1ee1abcd5f21b1691
SHA1 2e922ec43943dc0494ba749e7f4d63b6a1fa2fef
SHA512 691ff8dfd43b69e28bfef09ebd7d9125094b3468a5a4b9c88f3dbb00cb85835cec6529a3d3d2a6c305188d57c71f5c2dced6ae465975fa69bce28615e29a4144
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3740-22-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

memory/3740-2-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

memory/3740-1-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

memory/3740-0-0x0000000074BA2000-0x0000000074BA3000-memory.dmp

Download

memory/4792-23-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

memory/4792-24-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

memory/4792-26-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

memory/4792-27-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

memory/4792-28-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

memory/5016-8-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

memory/5016-18-0x0000000074BA0000-0x0000000075151000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads