metamorpherrat | 52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe
Size 78KB
Sample240901-15wpwatbjk
SHA256 52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425
MD5 3784c386294c29944aa417f8bc747fc5
SHA1 b87795f05d0682c96fc4a4ea9c56b4b4fbad02df
SHA512 1ded30f4d9da8c6bb045a634ffe804af46b4a3278cee09a27ef165bcea45797a28c773ebe3001fe9bf2fbb765187c89bcb454beba8c058fe3c9e4f6f9e423239
SSDEEP 1536:gXc5jS1AlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6y9/Vs1HS:gc5jS1AtWDDILJLovbicqOq3o+nK9/V7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe

Deletes itself 1 IoCs

pid	Process
3296	tmpB99B.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3296	tmpB99B.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmpB99B.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB99B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe
Token: SeDebugPrivilege	3296	tmpB99B.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1892	2912	52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe	86
PID 2912 wrote to memory of 1892	2912	52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe	86
PID 2912 wrote to memory of 1892	2912	52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe	86
PID 1892 wrote to memory of 4916	1892	vbc.exe	88
PID 1892 wrote to memory of 4916	1892	vbc.exe	88
PID 1892 wrote to memory of 4916	1892	vbc.exe	88
PID 2912 wrote to memory of 3296	2912	52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe	89
PID 2912 wrote to memory of 3296	2912	52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe	89
PID 2912 wrote to memory of 3296	2912	52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe	89

C:\Users\Admin\AppData\Local\Temp\52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe
"C:\Users\Admin\AppData\Local\Temp\52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a1zmnppt.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA38.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDF5F2A8E61E74C72BF72FA7B69E470A0.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
- C:\Users\Admin\AppData\Local\Temp\tmpB99B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB99B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\52918436538cc174aa4e8d6e1fb5a89a04f0120904c1426aefc7367c6966c425.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESBA38.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBA38.tmp
Size 1KB
SHA256 a442343be6f47ae2580d885f4b35d0bf7fc062f774c1608884afe1cf07b79148
MD5 892ad0e2dda6d7a2b834d059a81c77cd
SHA1 a7bd2257eb3fd9b7e5420623ca08663614976401
SHA512 aecb7d59c444d653fe40f6f438e48b350fde89a0febce3cb8a2cf91da59262000d164d02906facbb65cffad11c408cfeac3840f09801653fcdaa5595991b2f87
MD5 SHA1 SHA512

Submit Download

a1zmnppt.0.vb

Path C:\Users\Admin\AppData\Local\Temp\a1zmnppt.0.vb
Size 14KB
SHA256 d338f885329ff202b0143d023387303535b1118620411d23b54ff88bae38ad29
MD5 58ea3f4ec552a23edd5ef8699e16cc03
SHA1 8a9e3239e9fd1bbd61e73d4650db24b0cf6afa8f
SHA512 b7117cc305d046d7ad832e4cf9db1a01d1cd7d3baa0cabc6e711a607b17c0bd8844cb5cac671742b6a8ea3b91b7c0e3a0e5fe5e50f3bd199e0b2318610572ce3
SSDEEP 384:rMiNlG5N77NLNxOANFNEcHbufE6NyzN7QvSN7eP:LkTt5H3EcHC7yhw+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

a1zmnppt.cmdline

Path C:\Users\Admin\AppData\Local\Temp\a1zmnppt.cmdline
Size 266B
SHA256 9f9b9ad7a97d567bf382af3c4f23d36dc06a879c5b1677f086057ecc74d7a5e0
MD5 e88e7d98053728a5da6bfdb0b274146d
SHA1 5a8a5b1777ea17c2ba25873bafdaf290147739df
SHA512 e5b45f93e8309fb1a807cb41cee9df58d7aedebe73e8757295b0686ec2fd57b6328209d64fb395b701bb996c4c0505d550ffb221e23a1084a150be645d2a5bae
MD5 SHA1 SHA512

Submit Download

tmpB99B.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpB99B.tmp.exe
Size 78KB
SHA256 826fdd41a7c4b63957dfe6ef4b1120df09a218230236225bf5d1216895b7a00e
MD5 08937de30b82bcaae09229f5604a4882
SHA1 3fd13a67bd6f502cf33986e70ccff19fc438a557
SHA512 1c09b63df4efd017d4b743b5ad2bdae3f61440ca802e966e01c5190bf7a6154dd0966faa288b46ca663c52f03af21fae2770f97782d783c368f536d9c5002818
SSDEEP 1536:OmCHHuaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtLy9/a51D:PCH/3ZAtWDDILJLovbicqOq3o+nLy9/U
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcDF5F2A8E61E74C72BF72FA7B69E470A0.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDF5F2A8E61E74C72BF72FA7B69E470A0.TMP
Size 660B
SHA256 8841b62f5b06a4d8911b471a5eb8d59dd200e64315f08a382e84f9c4fd801943
MD5 eabb068be2d8827152dd28df8a94ce63
SHA1 a1531e790de8aa7fc27941337c150b22154aab79
SHA512 7dc47569245d6a9dabb17ed89a79bcac0e9c9df3a422f46a1a1983bca7f1d423e00f154dd4f54d340def48aec0e2130cf7b2b1d7b9b3544300878287480f4bd2
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5
MD5 a26b0f78faa3881bb6307a944b096e91
SHA1 42b01830723bf07d14f3086fa83c4f74f5649368
SHA512 a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c
SSDEEP 1536:sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtQ:sAtWDDILJLovbicqOq3o+nQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1892-9-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

memory/1892-18-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

memory/2912-0-0x0000000074662000-0x0000000074663000-memory.dmp

Download

memory/2912-2-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

memory/2912-1-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

memory/2912-22-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

memory/3296-24-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

memory/3296-23-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

memory/3296-25-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

memory/3296-26-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

memory/3296-27-0x0000000074660000-0x0000000074C11000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads