metamorpherrat | d5e3d2731b1f910dfb7c78ba831153ef85d1dc76b88ff67b64ad9fd648eddaa7

Analysis

max time kernel
119s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2024, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b16fc1a0268ecfcae11b4211e859720N.exe
Size 78KB
Sample240830-s2zy5asekr
SHA256 d5e3d2731b1f910dfb7c78ba831153ef85d1dc76b88ff67b64ad9fd648eddaa7
MD5 8b16fc1a0268ecfcae11b4211e859720
SHA1 f6ed96e46f99394c0775180b494942cdc15012c9
SHA512 8c87d29ff230c4dc7fff1ca115243dfe1985b215f651596e2a48bf650f0f1ceea399035f2f472e5bbb1123d5669b07c519596628e2bb4f91666ce77df7dc3824
SSDEEP 1536:4osHY6uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtM9/n1ve:/sHYI3ZAtWDDILJLovbicqOq3o+nM9/c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	8b16fc1a0268ecfcae11b4211e859720N.exe

Executes dropped EXE 1 IoCs

pid	Process
2584	tmpC738.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmpC738.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC738.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b16fc1a0268ecfcae11b4211e859720N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	8b16fc1a0268ecfcae11b4211e859720N.exe
Token: SeDebugPrivilege	2584	tmpC738.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3252	2416	8b16fc1a0268ecfcae11b4211e859720N.exe	84
PID 2416 wrote to memory of 3252	2416	8b16fc1a0268ecfcae11b4211e859720N.exe	84
PID 2416 wrote to memory of 3252	2416	8b16fc1a0268ecfcae11b4211e859720N.exe	84
PID 3252 wrote to memory of 4576	3252	vbc.exe	86
PID 3252 wrote to memory of 4576	3252	vbc.exe	86
PID 3252 wrote to memory of 4576	3252	vbc.exe	86
PID 2416 wrote to memory of 2584	2416	8b16fc1a0268ecfcae11b4211e859720N.exe	90
PID 2416 wrote to memory of 2584	2416	8b16fc1a0268ecfcae11b4211e859720N.exe	90
PID 2416 wrote to memory of 2584	2416	8b16fc1a0268ecfcae11b4211e859720N.exe	90

C:\Users\Admin\AppData\Local\Temp\8b16fc1a0268ecfcae11b4211e859720N.exe
"C:\Users\Admin\AppData\Local\Temp\8b16fc1a0268ecfcae11b4211e859720N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xje3pvcd.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC89F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDA716CF69F9342E9889857352378332F.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- C:\Users\Admin\AppData\Local\Temp\tmpC738.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpC738.tmp.exe" C:\Users\Admin\AppData\Local\Temp\8b16fc1a0268ecfcae11b4211e859720N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC89F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC89F.tmp
Size 1KB
SHA256 0f7422336735b1877d8d51cb8495fe220cd32ed1dec295f251db5068e51bce43
MD5 7801c164066a12299444512bd24ca66e
SHA1 73927094ec1511afbd22bae958dba1ab7b4e73b2
SHA512 79fddaecbc3134c2c36a4e985ec32bb6a7fa2b104d462731fe7a19487b20febc835a28a8c0b59c9ce872e1d869e73f087c18c94a19881c307b7d0fc48ba08fca
MD5 SHA1 SHA512

Submit Download

tmpC738.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpC738.tmp.exe
Size 78KB
SHA256 d202073f4828dd67894b948477114e0c39cd4bfe0637d0ac57c09750516e26e9
MD5 3b74c74dc7815cff9da9350cf15bdc87
SHA1 2e8621c2f84f58e6491355122dac51f1cf387e7a
SHA512 d3f0c3a9d78dc15d0b5b6e674856f11fdd1662838e7d234aea0982fe3d0118317eab6aa90d8a960387d6c019de8847e26cdaa64144b07af8fb58bdf457966fac
SSDEEP 1536:DVPy5jSWAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qtd6X9/U1qw:xPy5jSWAtWDDILJLovbicqOq3o+no9/u
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcDA716CF69F9342E9889857352378332F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDA716CF69F9342E9889857352378332F.TMP
Size 660B
SHA256 ff6ed6c701eafaa29d4c7ef5f40b527902d39b9f10e9881b2ff64017eb1a30b0
MD5 75f9b710a736bf1c01437df599068fe9
SHA1 5be59622e37309014e516343b6c3655b707fecd9
SHA512 fbb22e7d2d529d5deee6547661856c3494f0ef6f5cfb990f10499d3754fb07d7ca328696fe06a23099b02ea13094242f993f9a1a10902113394431a335c21b6e
MD5 SHA1 SHA512

Submit Download

xje3pvcd.0.vb

Path C:\Users\Admin\AppData\Local\Temp\xje3pvcd.0.vb
Size 15KB
SHA256 a0f0185effd63dc6b208c4ad6a5326be5f6d39b60132e76825051248eb338e89
MD5 1dc16b45dfa695816350c6018fb2dc51
SHA1 886571969ba912cad5adcf23d6e3fe9e0572c719
SHA512 89cd989827b757fecffd5777d9106a05f3599c653b5d00e83b840f5f3d9e87b4a8bb12008ddb6539e5b54106fe5b82875d9faedb1f99cf08d069f33772883020
SSDEEP 384:rqN5JNSuNXNO4vuV7dDNM0N/cHbiqE6NWzN7QMSN7eP:q5DVdXmvRh/cH5Whx+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

xje3pvcd.cmdline

Path C:\Users\Admin\AppData\Local\Temp\xje3pvcd.cmdline
Size 266B
SHA256 a5222a3e2a4e2e09b43b13537ff6622cd09b3770bfb2f3fae268423bfa807f63
MD5 18273219bc8b3bbdfa502da6b8c18632
SHA1 8545db76ad0b0588d4f4b187637cbc0d6a830dfb
SHA512 784cf3edb4554d8dcb19b863464dcc70c1d8926b71bf76cc1b250b76513dd8b530365aa3bb5bcc7aa58a9a910e520df7eec2aed3dc4e6699f8ce431c184dd84b
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5
MD5 a26b0f78faa3881bb6307a944b096e91
SHA1 42b01830723bf07d14f3086fa83c4f74f5649368
SHA512 a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c
SSDEEP 1536:sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtQ:sAtWDDILJLovbicqOq3o+nQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2416-1-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

memory/2416-2-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

memory/2416-0-0x0000000074CE2000-0x0000000074CE3000-memory.dmp

Download

memory/2416-22-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

memory/2584-23-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

memory/2584-24-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

memory/2584-25-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

memory/2584-26-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

memory/2584-27-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

memory/3252-9-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

memory/3252-18-0x0000000074CE0000-0x0000000075291000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads