metamorpherrat | 6ec7e6e0d3d3f1699fa17ec1a29bc71162acc7ae9c85e94db5d1222b16abe758

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a183398c50099b929d55e35b7bfff180N.exe
Size 78KB
Sample240908-mdkxea1anp
SHA256 6ec7e6e0d3d3f1699fa17ec1a29bc71162acc7ae9c85e94db5d1222b16abe758
MD5 a183398c50099b929d55e35b7bfff180
SHA1 0df5ab7b0ee42ab88e04e8886bf4a25357c8b8b4
SHA512 dd9aa3b3df05be746f1a8924fc2f4e6b428d529f4d7f9843a8e267f8425e42f3971a09e4fee4d7a42acce36719498722d22927164db2e14ee982b8b03dfadcd4
SSDEEP 1536:LHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtK9/61qU:LHY53Ln7N041QqhgK9/M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	a183398c50099b929d55e35b7bfff180N.exe

Deletes itself 1 IoCs

pid	Process
3172	tmp9CDC.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3172	tmp9CDC.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp9CDC.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a183398c50099b929d55e35b7bfff180N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9CDC.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	a183398c50099b929d55e35b7bfff180N.exe
Token: SeDebugPrivilege	3172	tmp9CDC.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2524	2920	a183398c50099b929d55e35b7bfff180N.exe	84
PID 2920 wrote to memory of 2524	2920	a183398c50099b929d55e35b7bfff180N.exe	84
PID 2920 wrote to memory of 2524	2920	a183398c50099b929d55e35b7bfff180N.exe	84
PID 2524 wrote to memory of 4572	2524	vbc.exe	87
PID 2524 wrote to memory of 4572	2524	vbc.exe	87
PID 2524 wrote to memory of 4572	2524	vbc.exe	87
PID 2920 wrote to memory of 3172	2920	a183398c50099b929d55e35b7bfff180N.exe	89
PID 2920 wrote to memory of 3172	2920	a183398c50099b929d55e35b7bfff180N.exe	89
PID 2920 wrote to memory of 3172	2920	a183398c50099b929d55e35b7bfff180N.exe	89

C:\Users\Admin\AppData\Local\Temp\a183398c50099b929d55e35b7bfff180N.exe
"C:\Users\Admin\AppData\Local\Temp\a183398c50099b929d55e35b7bfff180N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qndb1nja.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DE6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDF54BC7D60E3463BB0AF156796D69DB0.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4572
- C:\Users\Admin\AppData\Local\Temp\tmp9CDC.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9CDC.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a183398c50099b929d55e35b7bfff180N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9DE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9DE6.tmp
Size 1KB
SHA256 3c60ea5f4ab9e4723ddd4e505587f27ec7de8705b546148ccffabd09aaa2cb41
MD5 d8bc9d44e29413ceb18d45d224ec894f
SHA1 fc016eb8c0bd7c734aacc54be24e5ff024ab31e1
SHA512 a9d53069441cb1766fbe830d0739cc73da5cfefeb51d7711498b1015fe17b51f77ed0547007c8429a3296b18fd066afdd69ce830c11828814687d5f85af1542b
MD5 SHA1 SHA512

Submit Download

qndb1nja.0.vb

Path C:\Users\Admin\AppData\Local\Temp\qndb1nja.0.vb
Size 15KB
SHA256 6bf6935691769c54f69f8165ff0687cac18c7ba7803dcc0b2d9008be37b3ed0b
MD5 d8a727f9bb330277242bd215535d5a71
SHA1 cce813b3216acfca545b59fb2f798377b7f1bc36
SHA512 df061ac56342dc683a55affeb6eab7ad0af43e8430b86e33f37f4e82995c4ce8f6ae50f30b6dab4c5d378173aff5478eaeccabc4d1f56c1284763142497cc87c
SSDEEP 384:rGJaNpNJpNON/gWXNVqNpcHbcE6N+zN7QgSN7eP:SQjJjiI8V2pcH8+hF+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

qndb1nja.cmdline

Path C:\Users\Admin\AppData\Local\Temp\qndb1nja.cmdline
Size 266B
SHA256 663e71c8c20effcaff1bfb7e9fb0f3f8fe3b5b537807ebee1321d1419f13e7c0
MD5 68b3f7427d24bd83e3846cf2a50c8dee
SHA1 26d4386de764285673956b954d732a7b01048f61
SHA512 3c2c74bd83c27932b7f92d19e003e02ce0afb500ad0796954c69d1ffe7dbdfbb8d0eaa56215090e97bbcc71c231db4998395dd9a049bc62cbe844fa7cb85b9f8
MD5 SHA1 SHA512

Submit Download

tmp9CDC.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp9CDC.tmp.exe
Size 78KB
SHA256 bd15c5d05520f580d5fd3465a6f354c55e053b6e5b417cfa634da7e92ab04bc8
MD5 8cf7381b5fef7b971a4d5ac11419508f
SHA1 739d515d69035cb82140d8519bd148d7ebc720d3
SHA512 9be83ab5239ee6e87f5f46f089d0687838b01dd4261bee2a7c2ddb8abe73b1bbe44a8b9f4f758e76120dfc5f23a2bcd630995ec3771aa5fe453e960b36222d04
SSDEEP 1536:iRy5jydy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt96E9/H1TJ:iRy5jtn7N041QqhgT9/b
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcDF54BC7D60E3463BB0AF156796D69DB0.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDF54BC7D60E3463BB0AF156796D69DB0.TMP
Size 660B
SHA256 233262bafec0f7a8b3876a48b7c0d8588d4c1852b66b1d4045e0b1d54112d165
MD5 e70836b89d04705a295b4841287628e2
SHA1 f205c46d50431bd3aeb2c78bd681d04cef2cd211
SHA512 fb1bc38a7c90c6ecd41b748d1f54b94ca911bfe1f39edcb9f8521ffa09b07b88b3f703bd0e8e00a49b7fee9fb56c6da4cbce69bfd8f86dacddcdf3a389a57cb6
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
MD5 aa4bdac8c4e0538ec2bb4b7574c94192
SHA1 ef76d834232b67b27ebd75708922adea97aeacce
SHA512 0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
SSDEEP 1536:edy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtQ:pn7N041QqhgQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2524-8-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/2524-18-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/2920-0-0x0000000075022000-0x0000000075023000-memory.dmp

Download

memory/2920-2-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/2920-1-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/2920-23-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/3172-22-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/3172-25-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/3172-26-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/3172-27-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads