metamorpherrat | a1c248b32dfbbe9bc4a5102d34bafddd0249811d365ca54b6293c27d3d685fe5

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6699bb1d68d09b0a25589fb13b288c40N.exe
Size 78KB
Sample240906-emykvsveqp
SHA256 a1c248b32dfbbe9bc4a5102d34bafddd0249811d365ca54b6293c27d3d685fe5
MD5 6699bb1d68d09b0a25589fb13b288c40
SHA1 68ab0da432ebfc555aced50546d5461955bee356
SHA512 57b57959bde66ba49f7c0b5479ef5df024734c174d8a2e14abad810639bfe3de97f1c190fe99ce0adf9a88f71fa612b4eb2ae44d0a0b676ee1a589653ad211d8
SSDEEP 1536:JBWtHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtew9/819s:TWtHY53Ln7N041Qqhgew9/f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	6699bb1d68d09b0a25589fb13b288c40N.exe

Executes dropped EXE 1 IoCs

pid	Process
4656	tmp5213.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp5213.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6699bb1d68d09b0a25589fb13b288c40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5213.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	6699bb1d68d09b0a25589fb13b288c40N.exe
Token: SeDebugPrivilege	4656	tmp5213.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 1036	4832	6699bb1d68d09b0a25589fb13b288c40N.exe	92
PID 4832 wrote to memory of 1036	4832	6699bb1d68d09b0a25589fb13b288c40N.exe	92
PID 4832 wrote to memory of 1036	4832	6699bb1d68d09b0a25589fb13b288c40N.exe	92
PID 1036 wrote to memory of 1568	1036	vbc.exe	94
PID 1036 wrote to memory of 1568	1036	vbc.exe	94
PID 1036 wrote to memory of 1568	1036	vbc.exe	94
PID 4832 wrote to memory of 4656	4832	6699bb1d68d09b0a25589fb13b288c40N.exe	96
PID 4832 wrote to memory of 4656	4832	6699bb1d68d09b0a25589fb13b288c40N.exe	96
PID 4832 wrote to memory of 4656	4832	6699bb1d68d09b0a25589fb13b288c40N.exe	96

C:\Users\Admin\AppData\Local\Temp\6699bb1d68d09b0a25589fb13b288c40N.exe
"C:\Users\Admin\AppData\Local\Temp\6699bb1d68d09b0a25589fb13b288c40N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qmertjii.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5484.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4F7BA3EF7D6244DD97B363D21F51A8.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1568
- C:\Users\Admin\AppData\Local\Temp\tmp5213.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5213.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6699bb1d68d09b0a25589fb13b288c40N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4344,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:8
1⤵
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5484.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5484.tmp
Size 1KB
SHA256 99ededde2d34f0b459149118eaa6b65e4e103af57551e14353a412207273bb6a
MD5 e135e644c93f44e18d452d8d209819ee
SHA1 8f9d804a5fe84e15eaae8fea8c9238228da44013
SHA512 d8bfcb5ea5476e72ef9f215dda60b92bfca8a5ef0d4b86fd62c5dd6f8b2dfa48c9fe14c287ba76cd1c148e880be481e7b375f9fc13ead7e025a979f9ef84413f
MD5 SHA1 SHA512

Submit Download

qmertjii.0.vb

Path C:\Users\Admin\AppData\Local\Temp\qmertjii.0.vb
Size 15KB
SHA256 7dc2b66054ab294a1fdbbd8e35cbc79fffd05d2f09f14ef972bdd1da99ddd96f
MD5 55f8e6716ec87a9b30fc08f9df2d7475
SHA1 a709f9f77284110174f483b4c78f9d1b246fcac5
SHA512 f316037b1143974065b44da5e31144d965fba17456c616174d6168fbc81c8cccc5a33e4a3cf21c70d7073b1077a1d9c617fb1ed33a0d48f5a8eff1020f3ef555
SSDEEP 384:rhN0N5TNKNNSvb7sNlN0scHb+CE6NRzN7Q7SN7eP:P05BWXXtcH1Rhy+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

qmertjii.cmdline

Path C:\Users\Admin\AppData\Local\Temp\qmertjii.cmdline
Size 266B
SHA256 e870c68415730f5b3412078514ae67ba445431553e22777604be3b0f0efe39fa
MD5 a809112207c208cbd3905e764b9b5a55
SHA1 57e530896943512e1817e9896077f672f2783e10
SHA512 9ceddc5a6546811993b2792f57440b3e99d1adadbe5b25055db8f3bb8643db2241cfc54cbd258d71e99605076e08b6bf56c5c08099efad6038dc57867e1c17af
MD5 SHA1 SHA512

Submit Download

tmp5213.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp5213.tmp.exe
Size 78KB
SHA256 47638ee17a212031df309a4f327590bc98b6b2ab4473860f7e903a559240952a
MD5 d0310fc3ff86578eecf510b5b7ead41e
SHA1 2467a12437b41cf2914835e0309e411332254484
SHA512 bda840afa53557a8f8badb66a25bdb48e7caeb14110827c1e3672bd09afad6a37ab20c5c492941d47e77071afede3412299148b3324b7954248069050f353d7e
SSDEEP 1536:2V5jS6dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6g9/ab1K2:2V5jS1n7N041Qqhgo9/w
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc4F7BA3EF7D6244DD97B363D21F51A8.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc4F7BA3EF7D6244DD97B363D21F51A8.TMP
Size 660B
SHA256 b17d28a39827dcbb25930dce11dc0d9b3c08d0cbb8cbee1c26075e6383da1349
MD5 53625225839d06786f0cecada28271af
SHA1 0b53af369f845c3d07e5f889b147e6554f21cc3a
SHA512 0c99e7f17a990cfba95011d4d7d96d5fa3d402d28692fc2584a6fb7ffd8e262607e9572103feff5c19135568c87d8e8997dde20c998f2c602300f8bab095986e
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1036-9-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/1036-18-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4656-23-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4656-24-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4656-25-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4656-27-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4656-28-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4656-29-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4832-22-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4832-1-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4832-2-0x0000000074670000-0x0000000074C21000-memory.dmp

Download

memory/4832-0-0x0000000074672000-0x0000000074673000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads