metamorpherrat | d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61

General

Target

d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe
Size

78KB
MD5

2cdf9b73fb1cb9ef82bed171e245daec
SHA1

6d1da6afcba47a11ad5c1d20c9df8c168d9b1a18
SHA256

d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61
SHA512

e12e93be3087c28cba543084df3d3d253f1b65862e9da77087a47bcac8d13a848edc24f8401a013df4cb97feb94486bcd3b55c8438ef576c5f0b73b05b99767a
SSDEEP

1536:URWtHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtRx9/O19p:URWtHa3Ln7N041QqhgRx9/U

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2672	tmp170A.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe
2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp170A.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp170A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe
Token: SeDebugPrivilege	2672	tmp170A.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1988	2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe	31
PID 2096 wrote to memory of 1988	2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe	31
PID 2096 wrote to memory of 1988	2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe	31
PID 2096 wrote to memory of 1988	2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe	31
PID 1988 wrote to memory of 2168	1988	vbc.exe	33
PID 1988 wrote to memory of 2168	1988	vbc.exe	33
PID 1988 wrote to memory of 2168	1988	vbc.exe	33
PID 1988 wrote to memory of 2168	1988	vbc.exe	33
PID 2096 wrote to memory of 2672	2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe	34
PID 2096 wrote to memory of 2672	2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe	34
PID 2096 wrote to memory of 2672	2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe	34
PID 2096 wrote to memory of 2672	2096	d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe	34

C:\Users\Admin\AppData\Local\Temp\d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe
"C:\Users\Admin\AppData\Local\Temp\d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\78kc3ndp.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1823.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1822.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
- C:\Users\Admin\AppData\Local\Temp\tmp170A.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp170A.tmp.exe" C:\Users\Admin\AppData\Local\Temp\d855ed74332ae7f1517bca3361e90a63180f79f18029efe0394d36d88fc22d61.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\78kc3ndp.0.vb

Filesize
15KB

MD5
b6ec13482af1f9472ad18d3b8bf8cf17

SHA1
d8ad51157e4c199782e970415a863a6497678629

SHA256
6a4bb1ed4c2797cdeb684174f25c51aa8ad3ffda9c5bba1f0915a411df1d086e

SHA512
525869984246be956ad64da8a158dc94be151802ffeaa55ad9c0e77bd82ba57d556fa305d78b89bff6d36cbef4688217290aaa9d11ee757ec400cfef2d080edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\78kc3ndp.cmdline

Filesize
266B

MD5
cc083fd43793cafd5a8d0287ec39d00a

SHA1
009dcf43db46ee9a03e72a3451ce6581e6ca6eb4

SHA256
26b1b6836dcdb444d432ba5a38f373a5d27b787d30bd690ae595d6a008a63e03

SHA512
d464d02848f08ac70502dc2e3c103682a01355a4b2c46d359af1911549081b57f2af7fe26d8219ae4daada8bfde2c54ceb4af42bac8f40024752d79677498c36

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1823.tmp

Filesize
1KB

MD5
5d2ae24a64167b55d63e3dc1517dcba8

SHA1
a44f4a23007323ade42843b6db3354860a905b80

SHA256
902b499c496f569f520337b667e0cea23421972e713fda989da27b4501cf8056

SHA512
d01366fdfbc649a74683f03a72053237e5dca18dfddd34eecef8deb4c761e75eb81728ff055d23b12870435e903060e9fdde03a617a03a88593f30ee5a3e07f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp170A.tmp.exe

Filesize
78KB

MD5
fc87bea0c80c6c075b43cba07dba8a05

SHA1
dc6fd2334218769c8a0c1782d2ad48764d0cf865

SHA256
234afbabd99a1fc877fc8dc5a337b6cb604ff56c22fc6ad98183b5fff744f501

SHA512
0cbaed0ffae0806805a227c522263f58d3e8ccaeb72147fa0c15d7889b4b8276fa0598337df0b003486fa2ac74538cad260c09bb3edf3e6ebf0db61d27bf4cd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1822.tmp

Filesize
660B

MD5
7dba6ea23d7daeb7c5fdcc3bd061a3c9

SHA1
0159bf7c3bbba3db1e477a8079a4a1fe0c450988

SHA256
5844db1661003ffa341435e4d2b01f0a1137aeabba6e8ea40b1cdb3a25d5c744

SHA512
8666ac605c4a2ef021a6137d63574313a28410e0a03399bed29c531410afe99dd5bf7f245d006a5c0491e2ce0142a9e8469ae2fdec25216089f9d37a3c2b50d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
aa4bdac8c4e0538ec2bb4b7574c94192

SHA1
ef76d834232b67b27ebd75708922adea97aeacce

SHA256
d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

SHA512
0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

Download Submit
memory/1988-9-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download
memory/1988-18-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download
memory/2096-0-0x0000000074B41000-0x0000000074B42000-memory.dmp

Filesize
4KB

Download
memory/2096-1-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download
memory/2096-2-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download
memory/2096-24-0x0000000074B40000-0x00000000750EB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads