metamorpherrat | dea8f4ff2ad43f1e92b8a43831472d9a7e383b09138dedbafca54c8084c400a1

General

Target

49546e74e611e45cbdd8cc24c9a6faf0N.exe
Size

78KB
MD5

49546e74e611e45cbdd8cc24c9a6faf0
SHA1

89f23dc38d0c74bf7acfffa00cf26d97e2af823f
SHA256

dea8f4ff2ad43f1e92b8a43831472d9a7e383b09138dedbafca54c8084c400a1
SHA512

024ce617d32c4553ce521ec4faca5467751d193ea6b6c2d41b06eb023af4ea01c52dded608deee41a9d6ac2e2e50d331deb35761659b155f18b962a309198dcd
SSDEEP

1536:Ry58MLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6O9/s1/5:Ry586E2EwR4uY41HyvYp9/A

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Deletes itself 1 IoCs

pid	Process
2988	tmpA8AE.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2988	tmpA8AE.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe
3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmpA8AE.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA8AE.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49546e74e611e45cbdd8cc24c9a6faf0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe
Token: SeDebugPrivilege	2988	tmpA8AE.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1532	3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe	30
PID 3060 wrote to memory of 1532	3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe	30
PID 3060 wrote to memory of 1532	3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe	30
PID 3060 wrote to memory of 1532	3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe	30
PID 1532 wrote to memory of 2040	1532	vbc.exe	32
PID 1532 wrote to memory of 2040	1532	vbc.exe	32
PID 1532 wrote to memory of 2040	1532	vbc.exe	32
PID 1532 wrote to memory of 2040	1532	vbc.exe	32
PID 3060 wrote to memory of 2988	3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe	33
PID 3060 wrote to memory of 2988	3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe	33
PID 3060 wrote to memory of 2988	3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe	33
PID 3060 wrote to memory of 2988	3060	49546e74e611e45cbdd8cc24c9a6faf0N.exe	33

C:\Users\Admin\AppData\Local\Temp\49546e74e611e45cbdd8cc24c9a6faf0N.exe
"C:\Users\Admin\AppData\Local\Temp\49546e74e611e45cbdd8cc24c9a6faf0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ndpxuol9.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9F6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA9F5.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2040
- C:\Users\Admin\AppData\Local\Temp\tmpA8AE.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA8AE.tmp.exe" C:\Users\Admin\AppData\Local\Temp\49546e74e611e45cbdd8cc24c9a6faf0N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESA9F6.tmp

Filesize
1KB

MD5
6979fa69b26d5b08b7e2b91c50763bb9

SHA1
f28c1a0d271c763748dd9c57ab192ead36645895

SHA256
f6a9d33269a1b7493f8a4db6ebd3a1a7a12dc8a3c5657b11041fad63e4990514

SHA512
bbb999e0b51f4dc368d1f8feee12681351eae1632cc4c4404e0d7a8402bbe04664a275fee57775a88236aac14bdced6805223275c8ca01aac59ea7fcf77db3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndpxuol9.0.vb

Filesize
14KB

MD5
068d9517e57174f18d78501bb87ad2c3

SHA1
72708e7d4fe3e964176a1b2012a817a9a466953c

SHA256
77d37adb3e11e218e4b43f8bd5c2cea3706e7a55c97e3d1e231194eef5623fcd

SHA512
e0fc1dbf95fc2160522d2ba338c9a0f2188bbe8e1bdaffaaab28a24b7472b77ce66c354205716f6178f1be6f1a681f5f616451735c7688154de057aa260af105

Download Submit
C:\Users\Admin\AppData\Local\Temp\ndpxuol9.cmdline

Filesize
266B

MD5
2a5e2264bd2e47a9b1b3586c6040a5db

SHA1
22ea0ae763769e0c298e0ca09093df1e5020a0dc

SHA256
f8f1177a8348d1725228908f2d1c1a51c5c455acb8c50bede1928f73987ed1af

SHA512
0c22b092a6a9724ca72d6c1d6589f027d3c944b7f91f781881156c0d6dfaa2fade258cd7ad5e088a807574ddb6cc1bea302a39f2743c138b2ea83527b1093a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA8AE.tmp.exe

Filesize
78KB

MD5
183994a7739883e9e96633c9f6736f1e

SHA1
1266bfc3b596deaf789e8bfa2c087928c27b5840

SHA256
98b77b87efd11e3b58ba8bbd1b7a739ae9502f603d0347c78ea301ac560fb418

SHA512
e673ed39deb8f30b39b9e9fcc30a801e5bf0cc978161576e13478544692ea780f06f08afe86e329538bd9e2e316a3e2bb09abf7328909810bf3cf1f1a7fdd1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcA9F5.tmp

Filesize
660B

MD5
26c62627b7790f9c022e9ee407358972

SHA1
8241d71db404de3ec4dcf29d9f9b09f44dfd7c69

SHA256
f0c002b7dc1f21f2c6ed28ef7ec5fb28fc06c8b348b9a84e1dd0217767483fa2

SHA512
8633a2d49ae0d6074e28fc670871a0de478d5747881c1200628b3f270f8d6bf3f4aaf21198d083b7857b162c6f18bf5494aa3422f5303e8660166c8fd2c97e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
6870a276e0bed6dd5394d178156ebad0

SHA1
9b6005e5771bb4afb93a8862b54fe77dc4d203ee

SHA256
69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

SHA512
3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

Download Submit
memory/1532-8-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/1532-18-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-0-0x0000000074BB1000-0x0000000074BB2000-memory.dmp

Filesize
4KB

Download
memory/3060-1-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-3-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-23-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads