metamorpherrat | 5b041ea35bd306fba33f6927a9c00763fce1401a93c48631ac05c5a2c2aabd01

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34a7acb4ec783f265ba0e9ef18802660N.exe
Size 78KB
Sample240805-chkgbstern
SHA256 5b041ea35bd306fba33f6927a9c00763fce1401a93c48631ac05c5a2c2aabd01
MD5 34a7acb4ec783f265ba0e9ef18802660
SHA1 7829296cc48c50e132fb11606fab14ee39a1d0e5
SHA512 ffcb950649d836e7bafe817ba926e922760050fbbb463215dad9697f2c276c3eff1d8d88824efce07abba3fe92a27b825187079953440ad23fd8073d2f5f21ba
SSDEEP 1536:ArjtHHuaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtPc99/zp:2jtH/3ZAtWDDILJLovbicqOq3o+nPc9F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	34a7acb4ec783f265ba0e9ef18802660N.exe

Executes dropped EXE 1 IoCs

pid	Process
4568	tmp2BBE.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmp2BBE.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34a7acb4ec783f265ba0e9ef18802660N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp2BBE.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	34a7acb4ec783f265ba0e9ef18802660N.exe
Token: SeDebugPrivilege	4568	tmp2BBE.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2512	2620	34a7acb4ec783f265ba0e9ef18802660N.exe	92
PID 2620 wrote to memory of 2512	2620	34a7acb4ec783f265ba0e9ef18802660N.exe	92
PID 2620 wrote to memory of 2512	2620	34a7acb4ec783f265ba0e9ef18802660N.exe	92
PID 2512 wrote to memory of 5020	2512	vbc.exe	95
PID 2512 wrote to memory of 5020	2512	vbc.exe	95
PID 2512 wrote to memory of 5020	2512	vbc.exe	95
PID 2620 wrote to memory of 4568	2620	34a7acb4ec783f265ba0e9ef18802660N.exe	96
PID 2620 wrote to memory of 4568	2620	34a7acb4ec783f265ba0e9ef18802660N.exe	96
PID 2620 wrote to memory of 4568	2620	34a7acb4ec783f265ba0e9ef18802660N.exe	96

C:\Users\Admin\AppData\Local\Temp\34a7acb4ec783f265ba0e9ef18802660N.exe
"C:\Users\Admin\AppData\Local\Temp\34a7acb4ec783f265ba0e9ef18802660N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0yyhhzrv.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CD7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEAB707B660D481C851E6F3628A62DC9.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
- C:\Users\Admin\AppData\Local\Temp\tmp2BBE.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp2BBE.tmp.exe" C:\Users\Admin\AppData\Local\Temp\34a7acb4ec783f265ba0e9ef18802660N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3668,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0yyhhzrv.0.vb

Path C:\Users\Admin\AppData\Local\Temp\0yyhhzrv.0.vb
Size 15KB
SHA256 9a032f2adeb3ac303dab51f76cf975355f96e94330d6d6c5d5e931114bc6ae5f
MD5 2a77a1ff30dd194f064eb111f1e0d069
SHA1 ae9dcdd7f1e41d8217dffc30e6646ff9942ddb6b
SHA512 9750ab5982d8fee696c70cf73bfe700fe176641d89a6d5891469f15b89f3f0548d6fff0c40accfc348a359ffc3b2fcb100b0b84acf862a457e5eb8d8b379f038
SSDEEP 384:rXNveNWNKNqclxNhyJNhcHbjE6NOzN7QtSN7eP:JvSKWBLoDhcHjOhI+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

0yyhhzrv.cmdline

Path C:\Users\Admin\AppData\Local\Temp\0yyhhzrv.cmdline
Size 266B
SHA256 080ee7ed84c06036a0dc24ddf805abe9ddc5a1f71024dfd8c17bb37a2dd83c78
MD5 a86b4e499efdbbb4194f73b6fbcc7eac
SHA1 3ade329e84e7b9796d3f2ae4f05aaf04e939f0ad
SHA512 679ab599d407c79385764b537b4607f2e3a2e64e4c01c37737389870774601d05dd6fab9a31f740a4e29d1590b19143ef37e20ec1b62d9c8f58c06a68f3cda04
MD5 SHA1 SHA512

Submit Download

RES2CD7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2CD7.tmp
Size 1KB
SHA256 1c7098f211ed25c4222f59c154f6f66384d993bc69c6129e6696c266caa50c6c
MD5 c1f88391e3e4e4bcaca4e2e8889bcda6
SHA1 7c6feae23981854b280f099b8be80c147b5bb1dd
SHA512 1b5f8da219502f83c34237d892e6a1a9a447ee3dc75ebab352851154beb856db9f4506c1d1b005bbc632ae22e2c21aa162a89be04373d4e39aef972df1855f70
MD5 SHA1 SHA512

Submit Download

tmp2BBE.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp2BBE.tmp.exe
Size 78KB
SHA256 8d924cd699199f6cdad90cad862ea78279db31d094612993fd2fc059ccc72ca2
MD5 27592dc3c275462ab2d58faf0483a2e1
SHA1 ae464342ccac37fa9bccd00fae8aef9bb6b9a914
SHA512 b0511e6d8eb0ea35a84f3cb351875d76f36b67689edaca6a717e88ecf9083d185397bc7c686287d8e050b6caf8e64da0c4b20c891ff23cfcdc1e55f07f42749c
SSDEEP 1536:XVRWV5bAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qtd6C9/T1GI:lRWV5bAtWDDILJLovbicqOq3o+nl9/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcEAB707B660D481C851E6F3628A62DC9.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcEAB707B660D481C851E6F3628A62DC9.TMP
Size 660B
SHA256 1689415210f605288b632aa8228ff58909b61e4d8073ff6a0dd74f8a1160b5e2
MD5 2410f4d0f0591682e65bfbf7d40a93b4
SHA1 624453e7dec7051c7cbaf23718bbdbed0f5cab9f
SHA512 ba866aecfd810ae1aef198c5cc74e9086df1ecce8f4bf80fb85b4c636aac4ec754c55c4befdedc1baf49c006fbfd5ab01a342cd1d3a8c5bb6a7da24e4a335f69
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5
MD5 a26b0f78faa3881bb6307a944b096e91
SHA1 42b01830723bf07d14f3086fa83c4f74f5649368
SHA512 a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c
SSDEEP 1536:sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtQ:sAtWDDILJLovbicqOq3o+nQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2512-18-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

memory/2512-9-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

memory/2620-0-0x0000000074C32000-0x0000000074C33000-memory.dmp

Download

memory/2620-2-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

memory/2620-1-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

memory/2620-22-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

memory/4568-23-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

memory/4568-24-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

memory/4568-25-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

memory/4568-26-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

memory/4568-27-0x0000000074C30000-0x00000000751E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads