metamorpherrat | 513782b3665da95ac0cf713c296caa57273000cdbe68c2855aa6853fdc4388b3

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87b144e61cd347c013f6e75ea7a3f4c0N.exe
Size 78KB
Sample240814-xqn5pstdpp
SHA256 513782b3665da95ac0cf713c296caa57273000cdbe68c2855aa6853fdc4388b3
MD5 87b144e61cd347c013f6e75ea7a3f4c0
SHA1 6a9f9746b3f7cedbb4fa3a726cf29233edaeed7e
SHA512 df05aa8655c878b26f291821600c7485e65c27f442e3cf2db4ad7163c9427c61fbc5856c09d1c0c77cc0722459499401d6984c393cca1d41e06fe016a81b697b
SSDEEP 1536:RPWV5Sdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96K9/KT1rA:RPWV5Nn7N041QqhgV9/1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	87b144e61cd347c013f6e75ea7a3f4c0N.exe

Executes dropped EXE 1 IoCs

pid	Process
4744	tmpC0DF.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmpC0DF.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87b144e61cd347c013f6e75ea7a3f4c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC0DF.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	87b144e61cd347c013f6e75ea7a3f4c0N.exe
Token: SeDebugPrivilege	4744	tmpC0DF.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1648	3696	87b144e61cd347c013f6e75ea7a3f4c0N.exe	87
PID 3696 wrote to memory of 1648	3696	87b144e61cd347c013f6e75ea7a3f4c0N.exe	87
PID 3696 wrote to memory of 1648	3696	87b144e61cd347c013f6e75ea7a3f4c0N.exe	87
PID 1648 wrote to memory of 5044	1648	vbc.exe	90
PID 1648 wrote to memory of 5044	1648	vbc.exe	90
PID 1648 wrote to memory of 5044	1648	vbc.exe	90
PID 3696 wrote to memory of 4744	3696	87b144e61cd347c013f6e75ea7a3f4c0N.exe	92
PID 3696 wrote to memory of 4744	3696	87b144e61cd347c013f6e75ea7a3f4c0N.exe	92
PID 3696 wrote to memory of 4744	3696	87b144e61cd347c013f6e75ea7a3f4c0N.exe	92

C:\Users\Admin\AppData\Local\Temp\87b144e61cd347c013f6e75ea7a3f4c0N.exe
"C:\Users\Admin\AppData\Local\Temp\87b144e61cd347c013f6e75ea7a3f4c0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wrzl4n12.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC208.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc611F2F7A24C4463A3878877323DA3A.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5044
- C:\Users\Admin\AppData\Local\Temp\tmpC0DF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpC0DF.tmp.exe" C:\Users\Admin\AppData\Local\Temp\87b144e61cd347c013f6e75ea7a3f4c0N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC208.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC208.tmp
Size 1KB
SHA256 a7e170a2968e48a740d051fd015cc46fd41d4cb5dc6a21290359b553c3a77c0a
MD5 7283a451ef162ee5874a47771feeb2cf
SHA1 481da0922d8fcb021f159a02815a1b9131e2b8e5
SHA512 6af6ee973fb8a487c0b8d7fc2aa6392ea080b06ce123f6fd17f450b01114e9c6e0afcaf36d25088fc92581fd490a51f1dde37f822a00f80aceaf5d88e2e37d50
MD5 SHA1 SHA512

Submit Download

tmpC0DF.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpC0DF.tmp.exe
Size 78KB
SHA256 4b57ab53f9330e1db6887a7e850ce99c24cf4ce5d1b62a5592ede1632ed512e8
MD5 8a489543860fecb08d0e7ff967e61fa9
SHA1 58b7a813f37e6f41a739f3a9cfbbe46c6fe9d682
SHA512 6a6c95842159a74e5c75f9346b70bd59cfdb3c9ccac85c71a94b74c6fc42b18824a813c7aa7734d7ad03d08802ae0d8a56e2c412ea7339a1db740f17b3053d71
SSDEEP 1536:ouHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQte79/41kP:ouHFq3Ln7N041Qqhge79/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc611F2F7A24C4463A3878877323DA3A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc611F2F7A24C4463A3878877323DA3A.TMP
Size 660B
SHA256 a991903563000e4ead14a7fba29cab37303fa3528d4f0769ddcb1093526a7ff9
MD5 e46a7b2c2c82ced4f6307e0592398af4
SHA1 f84eed591642e7540050cf75b58714323d0203fb
SHA512 27d0e3798237bf6b4af186bf78c069126c1ca4b00f1530208462fb7734a3a7ee60913c56eac3a8265c724b30b114fd8a680218d00b853c865539bf186af8e8d6
MD5 SHA1 SHA512

Submit Download

wrzl4n12.0.vb

Path C:\Users\Admin\AppData\Local\Temp\wrzl4n12.0.vb
Size 14KB
SHA256 f8b76754b7888a325123fa4761f0c5c2af1cb30b0d2a72c7dc67c85e787a705e
MD5 e5eb22d05ece1ee77b206512aeea150b
SHA1 596733c72157f753c0f20e0c186b9aa4761310ca
SHA512 3b2cc28759d924592c94b816b7be8c67c1963524de31b918b0b1a78a130e0b5e90cd4c308972def6a934d90c6b25a5a0263a290fab0ee6366af1b14a1d3f6c1e
SSDEEP 384:rxNANm02NlNBVlnyNwNQcHb+E6NLzN7QZSN7eP:nomrX/le4QcHWLhq+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrzl4n12.cmdline

Path C:\Users\Admin\AppData\Local\Temp\wrzl4n12.cmdline
Size 266B
SHA256 2dccd4325a94087bcaa08d4d682b84d0f797c6dae553ece5df221631ab460e49
MD5 7973fd323495ad55236f05444b9ed163
SHA1 b0ad6ac6790d91ead6f33e74c90c81d88baacc2a
SHA512 53a23b11a6182ca199d871bd46464a699dd4913a666096c34b5cf4038a8d490097c9b315deddc84ba523984f47a9b9201b72b977a719c5ba18692b0b772616ce
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1648-18-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

memory/1648-9-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

memory/3696-1-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

memory/3696-2-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

memory/3696-0-0x0000000074972000-0x0000000074973000-memory.dmp

Download

memory/3696-22-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

memory/4744-24-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

memory/4744-23-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

memory/4744-26-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

memory/4744-27-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

memory/4744-28-0x0000000074970000-0x0000000074F21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads