metamorpherrat | 8140616b4377241557604d646a48e318789559a6a7f695ecfd9496aef0f04fec

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2024, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
78030fcfad102da49f7eab7e01138900N.exe
Size 78KB
Sample240815-mgrt5aybjf
SHA256 8140616b4377241557604d646a48e318789559a6a7f695ecfd9496aef0f04fec
MD5 78030fcfad102da49f7eab7e01138900
SHA1 49d35afb23e502d2ed70cd69cc0a04985e571a94
SHA512 70f6805f462f861b7a0025f5565a43a40b32b44ae9c325a390bab33126c3ee2773bfeaca73b95b7b580c6767ff38b90b2275fce744a44583a7f1324c12b251ec
SSDEEP 1536:/FtHFo6uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qt89/941:9tHFoI3ZAtWDDILJLovbicqOq3o+n89G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	78030fcfad102da49f7eab7e01138900N.exe

Deletes itself 1 IoCs

pid	Process
2448	tmp7B3B.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2448	tmp7B3B.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmp7B3B.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78030fcfad102da49f7eab7e01138900N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7B3B.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	78030fcfad102da49f7eab7e01138900N.exe
Token: SeDebugPrivilege	2448	tmp7B3B.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4004	3156	78030fcfad102da49f7eab7e01138900N.exe	85
PID 3156 wrote to memory of 4004	3156	78030fcfad102da49f7eab7e01138900N.exe	85
PID 3156 wrote to memory of 4004	3156	78030fcfad102da49f7eab7e01138900N.exe	85
PID 4004 wrote to memory of 3400	4004	vbc.exe	89
PID 4004 wrote to memory of 3400	4004	vbc.exe	89
PID 4004 wrote to memory of 3400	4004	vbc.exe	89
PID 3156 wrote to memory of 2448	3156	78030fcfad102da49f7eab7e01138900N.exe	90
PID 3156 wrote to memory of 2448	3156	78030fcfad102da49f7eab7e01138900N.exe	90
PID 3156 wrote to memory of 2448	3156	78030fcfad102da49f7eab7e01138900N.exe	90

C:\Users\Admin\AppData\Local\Temp\78030fcfad102da49f7eab7e01138900N.exe
"C:\Users\Admin\AppData\Local\Temp\78030fcfad102da49f7eab7e01138900N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vrdyebsz.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C92.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc72B39978A257477D9EBAD8C4BE24E49.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3400
- C:\Users\Admin\AppData\Local\Temp\tmp7B3B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp7B3B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\78030fcfad102da49f7eab7e01138900N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7C92.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7C92.tmp
Size 1KB
SHA256 edff7675f01344c2c5cdd0c87d847fb5eec72844daa15cb223975aea5d6a9172
MD5 b57c7f591d92b6192251a1854c32072d
SHA1 ab68443611aa8572404bb5e83a05b12d9d5c3cc2
SHA512 cb60d1ebf472f8a5adec67d6164ef60ff057264bd98341a3c0c708d7f810835beefa7bbf0bed825aa4e857f7677fd13249ca68ef6c576791bd2ed916a8984405
MD5 SHA1 SHA512

Submit Download

tmp7B3B.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp7B3B.tmp.exe
Size 78KB
SHA256 2c3750cd1e191d657412bad3f82d34236520de4ed6d190c3f946c07ffeb450d5
MD5 b56298b8252e0830a1f1ec7c5b300d97
SHA1 705bbb3e8d930923ae776ea5a942429a62628f4d
SHA512 c8a649b8441148d43362bad90e0a602140fc04d9882aa1ea41289daeda3958824e4aaba9daaa413f09bab87204e612afb5f716c3c0a6653a196ddcffd138d89c
SSDEEP 1536:DcV5jSuAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6q9/Q1DP:gV5jSuAtWDDILJLovbicqOq3o+nC9/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc72B39978A257477D9EBAD8C4BE24E49.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc72B39978A257477D9EBAD8C4BE24E49.TMP
Size 660B
SHA256 c331eb8a5bcb9dc92c50f6fd433eee6508daf69b91529000b46e4f59408e851f
MD5 47778c5a7ebcf0b22f13b1f20b2a5b22
SHA1 45e605454d88ac1f508593f8b2a9f2cbf0d955f8
SHA512 51737ccacf53dfbd9be9d00744da0521e81e690c0f5cda0846092539a66ed8d62350559ed212d550335edadbed6556d70ce07fdc39f89ce33ab7205c4f190643
MD5 SHA1 SHA512

Submit Download

vrdyebsz.0.vb

Path C:\Users\Admin\AppData\Local\Temp\vrdyebsz.0.vb
Size 15KB
SHA256 430372c04c9fdc004f575e6b90dd79e7e2d237e542771c7218af5c6e790ebf5c
MD5 85ed75781755575a9a5d8e87e5d24aee
SHA1 a85d69dba4d20066fb909177ec6db1a934be071b
SHA512 f1436f92ec96599d8c30a5e657a1e073cc9c589d380a81178b4e8f5032e453ffbc28747882d6787451c20ecd8270b8ae6190dcae46df71c68562641ae2093f69
SSDEEP 384:rtNW7NZNP0rNCmNZ3+BIN2WNJcHbRE6N3zN7QKSN7eP:LwsZTN++lJcHB3h7+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

vrdyebsz.cmdline

Path C:\Users\Admin\AppData\Local\Temp\vrdyebsz.cmdline
Size 266B
SHA256 8e2f3a9dac003b0fc2d4ac4608d1e05dcd9fe202c07dab2e77a5ffb99d3974a7
MD5 987ecf2b9e03c587614a6ad67c2b4358
SHA1 d7e867308beed975c30777289ed0b87adf6e31ce
SHA512 3c8a66bef5f1e8c25077fa4c806f00fa41d98e6cda366d326f53ad860f7e3df39594dd3935fe655270f3ec199183a99e935e1c7514d3de184c4128ee8a2ac46b
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5
MD5 a26b0f78faa3881bb6307a944b096e91
SHA1 42b01830723bf07d14f3086fa83c4f74f5649368
SHA512 a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c
SSDEEP 1536:sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtQ:sAtWDDILJLovbicqOq3o+nQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2448-24-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/2448-23-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/2448-25-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/2448-26-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/2448-27-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/3156-2-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/3156-1-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/3156-22-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/3156-0-0x0000000074CC2000-0x0000000074CC3000-memory.dmp

Download

memory/4004-9-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/4004-18-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads