metamorpherrat | dea8f4ff2ad43f1e92b8a43831472d9a7e383b09138dedbafca54c8084c400a1

General

Target

49546e74e611e45cbdd8cc24c9a6faf0N.exe
Size

78KB
MD5

49546e74e611e45cbdd8cc24c9a6faf0
SHA1

89f23dc38d0c74bf7acfffa00cf26d97e2af823f
SHA256

dea8f4ff2ad43f1e92b8a43831472d9a7e383b09138dedbafca54c8084c400a1
SHA512

024ce617d32c4553ce521ec4faca5467751d193ea6b6c2d41b06eb023af4ea01c52dded608deee41a9d6ac2e2e50d331deb35761659b155f18b962a309198dcd
SSDEEP

1536:Ry58MLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6O9/s1/5:Ry586E2EwR4uY41HyvYp9/A

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	49546e74e611e45cbdd8cc24c9a6faf0N.exe

Executes dropped EXE 1 IoCs

pid	Process
4824	tmp7C15.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp7C15.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49546e74e611e45cbdd8cc24c9a6faf0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp7C15.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3612	49546e74e611e45cbdd8cc24c9a6faf0N.exe
Token: SeDebugPrivilege	4824	tmp7C15.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3144	3612	49546e74e611e45cbdd8cc24c9a6faf0N.exe	82
PID 3612 wrote to memory of 3144	3612	49546e74e611e45cbdd8cc24c9a6faf0N.exe	82
PID 3612 wrote to memory of 3144	3612	49546e74e611e45cbdd8cc24c9a6faf0N.exe	82
PID 3144 wrote to memory of 804	3144	vbc.exe	84
PID 3144 wrote to memory of 804	3144	vbc.exe	84
PID 3144 wrote to memory of 804	3144	vbc.exe	84
PID 3612 wrote to memory of 4824	3612	49546e74e611e45cbdd8cc24c9a6faf0N.exe	85
PID 3612 wrote to memory of 4824	3612	49546e74e611e45cbdd8cc24c9a6faf0N.exe	85
PID 3612 wrote to memory of 4824	3612	49546e74e611e45cbdd8cc24c9a6faf0N.exe	85

C:\Users\Admin\AppData\Local\Temp\49546e74e611e45cbdd8cc24c9a6faf0N.exe
"C:\Users\Admin\AppData\Local\Temp\49546e74e611e45cbdd8cc24c9a6faf0N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zcy9eqwv.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CF0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc239E1F7131FC48EF82245D2C95982D2A.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:804
- C:\Users\Admin\AppData\Local\Temp\tmp7C15.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp7C15.tmp.exe" C:\Users\Admin\AppData\Local\Temp\49546e74e611e45cbdd8cc24c9a6faf0N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES7CF0.tmp

Filesize
1KB

MD5
a21fc0d8e97e5decc69e2727f3e957cd

SHA1
4bbdae53020492e4267e1868df778af822c87f4f

SHA256
7fcc25011fff1d6c042ad5f6d4c2bbb352d3cb0beef2bf08c10f8f3288c71c46

SHA512
c555b013aa384db2d0b796965242135e43d41db45b5f9964b3d6e2b3dc77e1b26c1ade28fbd9c55f87a7ae420b03d646cb1e5b5ab58613140ff5932da56dd5f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7C15.tmp.exe

Filesize
78KB

MD5
fc95cf500b9d835533ba348af766c283

SHA1
c78f89ca1ff373697ccf96af0f5a40ecd7e3ad26

SHA256
ea7364b3ccfb7f5b2b0a00e2f3f7af3fe7f09efcee7e7308470dfe11d548e9e8

SHA512
78fb5b896fc4be1f2a996b3ea779b561344aaa64a9235404801a57fc01b705011bfc6ffc7f16b79da52982db7fef86375c8956972453c373687beeaee2f68631

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc239E1F7131FC48EF82245D2C95982D2A.TMP

Filesize
660B

MD5
1b47d1f41f010b5570ab424a6e77c503

SHA1
971e2fc9a79adcac11ee891f541509e477a48199

SHA256
a3007a00bad7f7bc82528a23d7740bca3f8330ae39a183555b5aa915dc62a17e

SHA512
7e50ca058dff2a40f23d52f87e48e0fe11a4a3e95dff4c1d9be330dea2eebbc269bfc792d72c56b05a1ecd26e177a08b6e644cb111d079ace619885d720ec91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
6870a276e0bed6dd5394d178156ebad0

SHA1
9b6005e5771bb4afb93a8862b54fe77dc4d203ee

SHA256
69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

SHA512
3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

Download Submit
C:\Users\Admin\AppData\Local\Temp\zcy9eqwv.0.vb

Filesize
14KB

MD5
460fb84e5cebfeec13ba30b0707cd439

SHA1
986e8dff542022c33ce744dff18fbcc82eb8ec74

SHA256
10844b47fef35a9530c247066a739b3adc12669ffbbd1e432f82b223dbaeda77

SHA512
0c8b397f00ccb916fe7db13a454567acdb9dd825ef1b36ddf8b75b554dd5792e7cce0157113382f64364b6b5df99b229f99ba17fd7e8d1713d113ad6ca8bcb82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zcy9eqwv.cmdline

Filesize
266B

MD5
05d72009b0a3558762a2a07398f27e6a

SHA1
a4dab8cc6b1ecc8f5f75d8f67484c2672d5e8b29

SHA256
dead00796eed16c6a713e231dc475cb2943d1fe457f5adc767dcea9d0bb90a80

SHA512
6b2b25e074ee0137b13b28794849556a3a7a300f666a71030b514a45911069f26d5848ce4910b8cc12e961acfbf234f4f0924100d49b16fc355867a9aa7266ea

Download Submit
memory/3144-8-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/3144-18-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/3612-0-0x0000000074932000-0x0000000074933000-memory.dmp

Filesize
4KB

Download
memory/3612-2-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/3612-1-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/3612-22-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/4824-23-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/4824-24-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/4824-26-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/4824-27-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download
memory/4824-28-0x0000000074930000-0x0000000074EE1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads