metamorpherrat | f6c296666e91c94a4b6a6182e46faf8a3d5cb987dfbd9f0fad279598555e7926

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PWS.MSIL.Mintluks.exe
Size 78KB
Sample240916-mt1ykatbkc
SHA256 f6c296666e91c94a4b6a6182e46faf8a3d5cb987dfbd9f0fad279598555e7926
MD5 d24ac1b54324a1045b2c41aa72696b50
SHA1 11d3ba15cf6467b65859c2fc781aae8b01b0678d
SHA512 52b4aa63a1d9f60c8f8e80a8bc1a60481bb42fdd4ab81800e8b5df8a7bb2d511ca9b1bdce5aa7b562728f9267cfc4c74ec1a80971ef2e02542f1b05d05d9004b
SSDEEP 1536:B5jSZLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6qA9/51Aa:B5jSxE2EwR4uY41HyvYZA9/b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	PWS.MSIL.Mintluks.exe

Executes dropped EXE 1 IoCs

pid	Process
2568	tmpBF49.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmpBF49.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PWS.MSIL.Mintluks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBF49.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	PWS.MSIL.Mintluks.exe
Token: SeDebugPrivilege	2568	tmpBF49.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4564	3424	PWS.MSIL.Mintluks.exe	82
PID 3424 wrote to memory of 4564	3424	PWS.MSIL.Mintluks.exe	82
PID 3424 wrote to memory of 4564	3424	PWS.MSIL.Mintluks.exe	82
PID 4564 wrote to memory of 4776	4564	vbc.exe	84
PID 4564 wrote to memory of 4776	4564	vbc.exe	84
PID 4564 wrote to memory of 4776	4564	vbc.exe	84
PID 3424 wrote to memory of 2568	3424	PWS.MSIL.Mintluks.exe	85
PID 3424 wrote to memory of 2568	3424	PWS.MSIL.Mintluks.exe	85
PID 3424 wrote to memory of 2568	3424	PWS.MSIL.Mintluks.exe	85

C:\Users\Admin\AppData\Local\Temp\PWS.MSIL.Mintluks.exe
"C:\Users\Admin\AppData\Local\Temp\PWS.MSIL.Mintluks.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t4b389mv.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC043.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc181E91364ACC4645A75925D82974E95E.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
- C:\Users\Admin\AppData\Local\Temp\tmpBF49.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpBF49.tmp.exe" C:\Users\Admin\AppData\Local\Temp\PWS.MSIL.Mintluks.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC043.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC043.tmp
Size 1KB
SHA256 1e4db90485699277696c21ad5fbfec2ad8406ab617a2d55717e3868a3342edd6
MD5 4d1cdd15c56cee252c1d248b0f07847f
SHA1 27129f5472b74fd01302df16227e2cc32435a61c
SHA512 0833015269cd57ca3600bb9af4d875c907662170b7f8f107cc7a6d4c20f9f23cd95b66ac4a60673939601cbc6e6cfc217c20d0bf70d2a14f7abbf27b464c695c
MD5 SHA1 SHA512

Submit Download

t4b389mv.0.vb

Path C:\Users\Admin\AppData\Local\Temp\t4b389mv.0.vb
Size 14KB
SHA256 2eca024f8b3989adc3b80d10bf2031628f3bdfc20e9b51b6641dc21771e14275
MD5 21df46fb122b294c9a57457bd7376952
SHA1 05f86ba144704c13360a92a947680752ddfa2779
SHA512 86a4914b7e5e81b1176e002603420e0c559d8aadb3465af614a99e6af356527caece8d7c3eebcfd5e799965a51b706b217eaca892cbd1abefdac4755ab81ed2c
SSDEEP 384:rZNHNm6mNQxJSNE5Wbdj1LN9NkcHbwE6NzMzN7QrSN7eP:3t+Z15vkcHwzMhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

t4b389mv.cmdline

Path C:\Users\Admin\AppData\Local\Temp\t4b389mv.cmdline
Size 266B
SHA256 abcbadc62946151b7c1bcc016bcd4d5aaf286f9845268f84b921fdc362d9afe5
MD5 867c94dcb24583a4c9f265193de968c6
SHA1 c53894afed7403e34f9acf68e106f0dc93cee6df
SHA512 eb6a34da6ff360602581368b60307af0f250356ce2184da3c49ae4d3a60c53e59079c162a3ad38aff9c8c0e640627285b809de5ee8ba19f37347294194fdbd3b
MD5 SHA1 SHA512

Submit Download

tmpBF49.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpBF49.tmp.exe
Size 78KB
SHA256 8ef00990e7207dace8474ebe9155e006b413dfe365c45f2bc68144a9c795ec10
MD5 21d4c420966dc2d292fae96114018f71
SHA1 975481935bf62306b34242ccfe896baa3a604269
SHA512 03caefafa26b2192ffb8b0372d5ddf251ba81361c520d35de8b2d21dd002bba7810216ede343d5c8b10c7c2b5bce62fc846bd23fef98fce39f494a22b0d15312
SSDEEP 1536:PuHY6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLH9/ce15x:PuHY8dSE2EwR4uY41HyvYLH9/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc181E91364ACC4645A75925D82974E95E.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc181E91364ACC4645A75925D82974E95E.TMP
Size 660B
SHA256 5acf4507b862f1935dbe33a2b160a719b930783743916af5d590bb08327a2940
MD5 a4f3670ac26201d06e0d89ec9783d077
SHA1 f10068a4063635a5c152c4d82d5458ed7cc2d982
SHA512 f946a6f274788486d002401715dac5a8c7f07524b8a73dfab595ed68d693d737e27d925fed92097b5e8ae3cefe997dffb3e1f2e6604394e2682abe3c9cfe7238
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4
MD5 6870a276e0bed6dd5394d178156ebad0
SHA1 9b6005e5771bb4afb93a8862b54fe77dc4d203ee
SHA512 3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809
SSDEEP 1536:LLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtQ:3E2EwR4uY41HyvYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2568-23-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/2568-28-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/2568-27-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/2568-26-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/2568-24-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/3424-22-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/3424-0-0x00000000748C2000-0x00000000748C3000-memory.dmp

Download

memory/3424-2-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/3424-1-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/4564-18-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/4564-8-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads