metamorpherrat | 0092345c9172b7d0d862ff4489896e409f93e50839841147908fa4da949cd0d6

General

Target

b3730424ad591633e0c57b72b99609f0N.exe
Size

78KB
MD5

b3730424ad591633e0c57b72b99609f0
SHA1

449e56dcbeabfe045c5bdb820ac8c3ce50a25a75
SHA256

0092345c9172b7d0d862ff4489896e409f93e50839841147908fa4da949cd0d6
SHA512

4549086907d60718c19074a31d1bba2231e342c729fff8b8bb041bf439db5d39f42a31aa6a2e80fa3f5f9f3018eb6bbb26136d319cdb5b71883686c2ee2a5ecf
SSDEEP

1536:zVPy5jSIAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qtd609/S1sN:BPy5jSIAtWDDILJLovbicqOq3o+nT9/j

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	b3730424ad591633e0c57b72b99609f0N.exe

Deletes itself 1 IoCs

pid	Process
1232	tmp8397.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1232	tmp8397.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmp8397.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8397.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3730424ad591633e0c57b72b99609f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	b3730424ad591633e0c57b72b99609f0N.exe
Token: SeDebugPrivilege	1232	tmp8397.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4584	4448	b3730424ad591633e0c57b72b99609f0N.exe	85
PID 4448 wrote to memory of 4584	4448	b3730424ad591633e0c57b72b99609f0N.exe	85
PID 4448 wrote to memory of 4584	4448	b3730424ad591633e0c57b72b99609f0N.exe	85
PID 4584 wrote to memory of 4824	4584	vbc.exe	87
PID 4584 wrote to memory of 4824	4584	vbc.exe	87
PID 4584 wrote to memory of 4824	4584	vbc.exe	87
PID 4448 wrote to memory of 1232	4448	b3730424ad591633e0c57b72b99609f0N.exe	89
PID 4448 wrote to memory of 1232	4448	b3730424ad591633e0c57b72b99609f0N.exe	89
PID 4448 wrote to memory of 1232	4448	b3730424ad591633e0c57b72b99609f0N.exe	89

C:\Users\Admin\AppData\Local\Temp\b3730424ad591633e0c57b72b99609f0N.exe
"C:\Users\Admin\AppData\Local\Temp\b3730424ad591633e0c57b72b99609f0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wnm5fxiq.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES852E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc496E85814CD84047B8CC34EA68134C9.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4824
- C:\Users\Admin\AppData\Local\Temp\tmp8397.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8397.tmp.exe" C:\Users\Admin\AppData\Local\Temp\b3730424ad591633e0c57b72b99609f0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES852E.tmp

Filesize
1KB

MD5
020abef740409dc9d36e54bdecb4f37d

SHA1
3316206a82f4a5fd777261fc499d66d97fd59f66

SHA256
3e8ae4a6337304727038c2bd0542bb5f14037e3d04d7d2a72e5af43710b35b4e

SHA512
daf1565755147bd8372f450bf5ae6a0e90c16ffc4c45a5ded294e7e9a6e9d220e84859fde1b3dc90b50e0fc837b7dc389031fad7d13e67951a0471f6484c1b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8397.tmp.exe

Filesize
78KB

MD5
0eeca658eacf65a58be728a27986a03b

SHA1
31787823a77262702fd36c59398b0d64e46a2616

SHA256
eaee047d1b2ab2f38b7ae8a423d03c31b054320beec501deb012dac51110c65f

SHA512
f450a20ec8a10da5a3e6ea61b6918495b06627acbd00391335211303887dc8e998c4ac4a5baa0e441a8b87243f08b4ef7a7c508e339ef70a07f2ee5c2e604f2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc496E85814CD84047B8CC34EA68134C9.TMP

Filesize
660B

MD5
8ede2a9c9b42f5da670fdf4331011391

SHA1
a8e0ef1f17748539cfda7195df81e3344c1b10b9

SHA256
ab382b585b5c46c731ba0a4f283d72ee799ebfc1de88922effd61f4f93e82cc6

SHA512
3f3b0d265c5580fde34885596b42ca82f65b22851245730c4154a3fef7de30642bbcd3bab94af215c9534b61d8f4df874b297ddf92af50996c87654c363c8c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wnm5fxiq.0.vb

Filesize
14KB

MD5
e43840fbd137f9904614a43fd856e359

SHA1
2585966d3644f251667fe76dad7ee23363821d0f

SHA256
032c22fad9ca631b8d75c59e5a7a0c6c0cd1069b0a09a775bd30f23bc372f4dd

SHA512
3e06ae99c16294879cc12c1045c1ae1c1c142deaddeec257af1b0198feacadacf29e6ebd2512e715529c05c80f86b5cd95e814363c1605102d227086aa17aeed

Download Submit
C:\Users\Admin\AppData\Local\Temp\wnm5fxiq.cmdline

Filesize
266B

MD5
f154b1f2b95107f8e53b74f19765e749

SHA1
dda62d908703322b7f386a9ead747108251a7351

SHA256
6606a2f2d2cbf601b4dc7a4ea5274f73ede4e0c3119b5baf797c3efc26879a9b

SHA512
b0ea4ec0ba2bcb9255b0d531c9e37072d06585064143d18531dd45d18f610203586583550eda7b2045c91de4fd8848532bdabd43a4e3d3b5d60362c29d5a48eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
a26b0f78faa3881bb6307a944b096e91

SHA1
42b01830723bf07d14f3086fa83c4f74f5649368

SHA256
b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5

SHA512
a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c

Download Submit
memory/1232-24-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download
memory/1232-23-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download
memory/1232-25-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download
memory/1232-26-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download
memory/1232-27-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download
memory/4448-2-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download
memory/4448-1-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download
memory/4448-22-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download
memory/4448-0-0x0000000074A12000-0x0000000074A13000-memory.dmp

Filesize
4KB

Download
memory/4584-9-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download
memory/4584-18-0x0000000074A10000-0x0000000074FC1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads