metamorpherrat | 490802733102f1121bbc9875de90e765885050024088c0c73ed3a6fc3c7b38f1

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94b94a9659cfd4f14804da96a7c07580N.exe
Size 78KB
Sample240905-ftb6wavbpe
SHA256 490802733102f1121bbc9875de90e765885050024088c0c73ed3a6fc3c7b38f1
MD5 94b94a9659cfd4f14804da96a7c07580
SHA1 43966777da45767c1c941524fa7e329378f63f5e
SHA512 a9ae78896451ae31d0a627ab53dee042b49fa7ebcd025d3eb6010163f3e323b9c9fdac2e245b4fbd75b948cb54354b1308d4feb91fad4a1a7c26fbcec45eeba3
SSDEEP 1536:kWtHF3M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtR6K9/c11PG:kWtHF8hASyRxvhTzXPvCbW2UR6K9/Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	94b94a9659cfd4f14804da96a7c07580N.exe

Executes dropped EXE 1 IoCs

pid	Process
752	tmp86E3.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp86E3.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94b94a9659cfd4f14804da96a7c07580N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp86E3.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	94b94a9659cfd4f14804da96a7c07580N.exe
Token: SeDebugPrivilege	752	tmp86E3.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3600	3040	94b94a9659cfd4f14804da96a7c07580N.exe	87
PID 3040 wrote to memory of 3600	3040	94b94a9659cfd4f14804da96a7c07580N.exe	87
PID 3040 wrote to memory of 3600	3040	94b94a9659cfd4f14804da96a7c07580N.exe	87
PID 3600 wrote to memory of 4872	3600	vbc.exe	90
PID 3600 wrote to memory of 4872	3600	vbc.exe	90
PID 3600 wrote to memory of 4872	3600	vbc.exe	90
PID 3040 wrote to memory of 752	3040	94b94a9659cfd4f14804da96a7c07580N.exe	91
PID 3040 wrote to memory of 752	3040	94b94a9659cfd4f14804da96a7c07580N.exe	91
PID 3040 wrote to memory of 752	3040	94b94a9659cfd4f14804da96a7c07580N.exe	91

C:\Users\Admin\AppData\Local\Temp\94b94a9659cfd4f14804da96a7c07580N.exe
"C:\Users\Admin\AppData\Local\Temp\94b94a9659cfd4f14804da96a7c07580N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nidv0lfx.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87CD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc210C65F4674D45268F4F351748E3B352.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4872
- C:\Users\Admin\AppData\Local\Temp\tmp86E3.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp86E3.tmp.exe" C:\Users\Admin\AppData\Local\Temp\94b94a9659cfd4f14804da96a7c07580N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES87CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES87CD.tmp
Size 1KB
SHA256 97a32b529a1950b0dd1015f19d099d60eea72cf1645723669c90a4be42aec34d
MD5 9712f3f986c3cd40ab1a196e01c601c8
SHA1 d333d609cb317e671c6274ddec0d1064ab44891b
SHA512 1a7226e761ec38e54533692eacbb2e989e2777500c029348849071092bc3bbf3ea1a437f69abc7de929f4b1e82b3eafc37a1b6df5e684f0a632973467addd817
MD5 SHA1 SHA512

Submit Download

nidv0lfx.0.vb

Path C:\Users\Admin\AppData\Local\Temp\nidv0lfx.0.vb
Size 15KB
SHA256 91335e374037fe16efdaec5e38187ffadc746c8a8475322f8c2c98589bd8b681
MD5 2d8d2f754e1c880ab4190ef44100e30d
SHA1 0b470d068cf591ebde17664246da2c2e0bab33ac
SHA512 ea01c1ef49e37ce54bb54c8aeed4cfc7ed9a373f858602f2041d8e40abcb61cf09f54a69d6337098204bbf449ba001559195cfbdbf56403fca6674c1fd322738
SSDEEP 384:rgN/NJ1BNk5MNu1bNi8NVcHbgE6NtzN7QpSN7eP:MF3tEpVcHIthY+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

nidv0lfx.cmdline

Path C:\Users\Admin\AppData\Local\Temp\nidv0lfx.cmdline
Size 266B
SHA256 feef99a8e5ed0ff61a47aec38b069ceb35abf5ef6089b99478636a35b8ec3cec
MD5 70fe84e4fb6ed0b38cfd1225b8b5bf16
SHA1 c4dcac17ba43cc3b1a52cd8878eccf0380204c1f
SHA512 4915b5c6901a2a522c6a20af53a432daa61d03a395fffc174f8e6f2ad4ffbbb21ec8e276d3ff26446893f5169220e0958519353fc883c82c6b6ce5d9e94775b3
MD5 SHA1 SHA512

Submit Download

tmp86E3.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp86E3.tmp.exe
Size 78KB
SHA256 737879339b429b785acacb4b8d774b31937bea5c376650e0f5eb43a6c2623e31
MD5 a4b3b56b508e23b91fb8f924140667e5
SHA1 265d680479201362394532bdc7169af5eda07690
SHA512 321ac0d2d5926274951dbde854bfa579be08928909f5bcc58fdba0938820f58dee201b682cbe34b98c5d75c3f5a0125b7b60cf389967a5be141319af9c4100a3
SSDEEP 1536:8RWV5jIXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6B9/I1N1:8RWV5jQSyRxvhTzXPvCbW2Up9/2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc210C65F4674D45268F4F351748E3B352.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc210C65F4674D45268F4F351748E3B352.TMP
Size 660B
SHA256 0914289e33e4336d602e8a765ab03eeb0c288fdc793bfd3543f5f5b35a76c0e1
MD5 9c218176e6ec03fb989d542cdc8298de
SHA1 8ff8bde77ecd682eb3b87f6b34f46546f99c7a54
SHA512 e4bfd1d4c0d40946fc1ceda230ca60e2dce75265a79da89b6547b5343ee075b3f62703d86ff5448c375cc115eae4414325353d567068de7b9e6c92ebaca8eead
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/752-23-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

memory/752-28-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

memory/752-27-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

memory/752-26-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

memory/752-24-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

memory/3040-22-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

memory/3040-0-0x0000000075122000-0x0000000075123000-memory.dmp

Download

memory/3040-2-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

memory/3040-1-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

memory/3600-18-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

memory/3600-8-0x0000000075120000-0x00000000756D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads