metamorpherrat | 9bb70b4c36032803e8c25ef55326fad512e8e9d12dbf59830856ecda2272859a

General

Target

ba72cbfbd7fefe91a9455555addf1910N.exe
Size

78KB
MD5

ba72cbfbd7fefe91a9455555addf1910
SHA1

fec81f8b247b3e4e623f7e764613b26d3cfbb81b
SHA256

9bb70b4c36032803e8c25ef55326fad512e8e9d12dbf59830856ecda2272859a
SHA512

f2e2a4a24ccc512ce0100ff66640c1c30aae1213f5dfe7cdbf3f19066431efc381e8953d1baa3fbd7fdf751a331bdc073f07243b459b96bf2b6d1787c2355030
SSDEEP

1536:kXe5jSAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6D9/f1iT:Ue5jSAtWDDILJLovbicqOq3o+nr9/K

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2924	tmp9721.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2520	ba72cbfbd7fefe91a9455555addf1910N.exe
2520	ba72cbfbd7fefe91a9455555addf1910N.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmp9721.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9721.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba72cbfbd7fefe91a9455555addf1910N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	ba72cbfbd7fefe91a9455555addf1910N.exe
Token: SeDebugPrivilege	2924	tmp9721.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2432	2520	ba72cbfbd7fefe91a9455555addf1910N.exe	30
PID 2520 wrote to memory of 2432	2520	ba72cbfbd7fefe91a9455555addf1910N.exe	30
PID 2520 wrote to memory of 2432	2520	ba72cbfbd7fefe91a9455555addf1910N.exe	30
PID 2520 wrote to memory of 2432	2520	ba72cbfbd7fefe91a9455555addf1910N.exe	30
PID 2432 wrote to memory of 2024	2432	vbc.exe	32
PID 2432 wrote to memory of 2024	2432	vbc.exe	32
PID 2432 wrote to memory of 2024	2432	vbc.exe	32
PID 2432 wrote to memory of 2024	2432	vbc.exe	32
PID 2520 wrote to memory of 2924	2520	ba72cbfbd7fefe91a9455555addf1910N.exe	33
PID 2520 wrote to memory of 2924	2520	ba72cbfbd7fefe91a9455555addf1910N.exe	33
PID 2520 wrote to memory of 2924	2520	ba72cbfbd7fefe91a9455555addf1910N.exe	33
PID 2520 wrote to memory of 2924	2520	ba72cbfbd7fefe91a9455555addf1910N.exe	33

C:\Users\Admin\AppData\Local\Temp\ba72cbfbd7fefe91a9455555addf1910N.exe
"C:\Users\Admin\AppData\Local\Temp\ba72cbfbd7fefe91a9455555addf1910N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g702xcsi.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9889.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9888.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2024
- C:\Users\Admin\AppData\Local\Temp\tmp9721.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9721.tmp.exe" C:\Users\Admin\AppData\Local\Temp\ba72cbfbd7fefe91a9455555addf1910N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES9889.tmp

Filesize
1KB

MD5
7eb3041e87d7c2483327d25733af5ed8

SHA1
487880c79ddf05e69fdbf91debcab15e35e2bb82

SHA256
3fda2b37a3a3c9f5e12fbb9eb439bb5091e39ae6875e0b1e9d9ab87d7c03e562

SHA512
4360c01f0aeff7d81f6c2a6bc495e4addb9b1062e273b37f080affe183447854a1d3e3643078b6ac4199ccfcd5f3214292d680684d7f4e20aa817e1be19bb4d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\g702xcsi.0.vb

Filesize
14KB

MD5
faecd43399244f57f98c43e89406e5aa

SHA1
b4112190168a3bcb67c5db5972b1ef819c3faae4

SHA256
9993c024675bc39718219e88985d3e4ca216197192abea5da70ad723972b0dd6

SHA512
2d16af3dca610e31ebba41841eb77a1052b55148b61362feddc980c2db7c533d6ded55f9a4d816cf22f8309da79623b31d5b3f2cc1803769fb8c479b5bc4276e

Download Submit
C:\Users\Admin\AppData\Local\Temp\g702xcsi.cmdline

Filesize
266B

MD5
646067fd7f02e95e33f03d86f6cb881d

SHA1
43aa971dd2a959005d67ff1823ce52bbfff914b7

SHA256
9928088b408287cdea42ae181d4a7e125c3a1c45690cce9b22ef482aa8a3ebdb

SHA512
af65e286e21d21e26cb6ce3e92380b93d5c63006406031fe81990872e51f529c9fe6912867e6cb5e918c9078c7cc3068d40918ce8985df89f5de9a4a105b6028

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9721.tmp.exe

Filesize
78KB

MD5
93e6d5968a2716324ef8b7d0cd350705

SHA1
8b5e1e6eb030ce9733b49ed548b1aba35848d9fd

SHA256
28c0fb4040d68c12104c816815db51b6e3a0e50d0b67b9cc7afb60c5ae92f859

SHA512
433c1801f1809ceab6db4689208dba6faf19650e9005362e70066c085714685aaa798deb3d7c39f68b54ebedb07743461120ccda4ba5bc5ad3eb83995f10d1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc9888.tmp

Filesize
660B

MD5
3a5773e6f04dbdb5a3b58ff393627967

SHA1
ed6effeab723edca9f405ea2b2be30b794bac808

SHA256
b5b02a40721a2657a586058bd0e219f694aa035f24f3ff94f0766b10bf94554a

SHA512
6a7f50a2f5cb5d053727d3de0d0d61ac8486b9e78f220a0414b699ecef953b69e7b70d068e2bbf43257356679296904d0a5b5c7864b1fd5e5a076d3dacba9692

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
a26b0f78faa3881bb6307a944b096e91

SHA1
42b01830723bf07d14f3086fa83c4f74f5649368

SHA256
b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5

SHA512
a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c

Download Submit
memory/2432-8-0x0000000074910000-0x0000000074EBB000-memory.dmp

Filesize
5.7MB

Download
memory/2432-18-0x0000000074910000-0x0000000074EBB000-memory.dmp

Filesize
5.7MB

Download
memory/2520-0-0x0000000074911000-0x0000000074912000-memory.dmp

Filesize
4KB

Download
memory/2520-1-0x0000000074910000-0x0000000074EBB000-memory.dmp

Filesize
5.7MB

Download
memory/2520-5-0x0000000074910000-0x0000000074EBB000-memory.dmp

Filesize
5.7MB

Download
memory/2520-24-0x0000000074910000-0x0000000074EBB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads