metamorpherrat | 872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe
Size 78KB
Sample240918-3sr72azbma
SHA256 872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8
MD5 53a0181e0e53859d7bcb5885ed3c2c10
SHA1 95b9549dc0f0451959c45f67ffd77de794f40841
SHA512 14f2d6cb06bec727c175082934794c5cdda4b58ee2b85b8d6cca6cf49b313ecc096c233814d042d2398c4e80bffe08cad83d72d2841ece10056215913e2b4193
SSDEEP 1536:fcPCHFo6uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qt99/F3:kPCHFoI3ZAtWDDILJLovbicqOq3o+n97
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe

Executes dropped EXE 1 IoCs

pid	Process
1568	tmp4F44.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmp4F44.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4F44.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe
Token: SeDebugPrivilege	1568	tmp4F44.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4860	3008	872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe	89
PID 3008 wrote to memory of 4860	3008	872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe	89
PID 3008 wrote to memory of 4860	3008	872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe	89
PID 4860 wrote to memory of 4088	4860	vbc.exe	91
PID 4860 wrote to memory of 4088	4860	vbc.exe	91
PID 4860 wrote to memory of 4088	4860	vbc.exe	91
PID 3008 wrote to memory of 1568	3008	872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe	92
PID 3008 wrote to memory of 1568	3008	872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe	92
PID 3008 wrote to memory of 1568	3008	872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe	92

C:\Users\Admin\AppData\Local\Temp\872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe
"C:\Users\Admin\AppData\Local\Temp\872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wccnusno.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52DE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD23FE7CFBB624164AC369C1E28D17EEA.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4088
- C:\Users\Admin\AppData\Local\Temp\tmp4F44.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4F44.tmp.exe" C:\Users\Admin\AppData\Local\Temp\872408de261d52a97865abf9745812d7b9c0cbcdd3420776f8a201dea7ffa8a8N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4176,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES52DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES52DE.tmp
Size 1KB
SHA256 dd75f62d62d7e8a7cfadbc2cfef3e265aaf80a63c4647af4b098f28f0545ae6a
MD5 f8e300dba206856ec5c9666d86bc1230
SHA1 4ed7bc55c7fb4035e5634da1c7f1859bd2126f9a
SHA512 698b5dba1f6e38388a5b7010ba794ed6e2847ced9f32066c79135e89a199ff908fe4dd9eb528694bc9c86ca7770f0dcf87530d92fbd948b8722f6a345e1a9afc
MD5 SHA1 SHA512

Submit Download

tmp4F44.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4F44.tmp.exe
Size 78KB
SHA256 13234bb1057f3f78dbc0a9c12a2a56da253d73d1859ae91f2ba96cad99e2d265
MD5 ff5e51d81940b04a4ff5a2d09fb0ef65
SHA1 729c02bcca63c4ff184ea83e358ba0f2fc52812a
SHA512 159a7cc167c54e4dc03af2cfebc72d1beb2ff0449b7fc5e6d491ed86c96eeef5b9609636b0408c6ad19b7a49bedca04dff883f16f8431beb3335246526a491a6
SSDEEP 1536:McV5jSWAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6o9/wB1Ut:hV5jSWAtWDDILJLovbicqOq3o+nA9/f
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcD23FE7CFBB624164AC369C1E28D17EEA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD23FE7CFBB624164AC369C1E28D17EEA.TMP
Size 660B
SHA256 235d740121cafcb2447695832a836bde154229b98364919a10d0e6a711fd29ba
MD5 b5d5b7a943edf91033684ca44958fff2
SHA1 d9d818679e241504d8cc29864f9c68d77b41ee8c
SHA512 4fdd1526a6cafe885181ec909b04ba95128d215d8d307aaf6ec3d5c2c9cc7b2e6112bcbe85617971c21a1cb824972ee34aff78f81f3bb4e0f7cfa9c1ae33d68f
MD5 SHA1 SHA512

Submit Download

wccnusno.0.vb

Path C:\Users\Admin\AppData\Local\Temp\wccnusno.0.vb
Size 15KB
SHA256 e82fda4d7c85f197dc23a2d3a71fe9034a0e7e762c1f118d5a6cd3a1425f4858
MD5 9d38bdfb54267a65a76227912b9fbe38
SHA1 1ea65a0d470cc9980dc11570a2ea1e0b402ec284
SHA512 59c1e00b0623b84e93a42d6ee39c466d6959a19cc7eeee8c16623798f8c27745aef6aee700ad005207d82369fa859a55e02fa87a03d3a63a6c04f118e2011fcc
SSDEEP 384:rbNrNFNrNxDLaNgNzcHbQE6N0zN7QVSN7eP:NZ3ZxGIzcH40h8+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

wccnusno.cmdline

Path C:\Users\Admin\AppData\Local\Temp\wccnusno.cmdline
Size 266B
SHA256 95dd1f1f04e5a5ce5da1b1c77042799479d9a79766b8cb71df07c6c68fc4dd25
MD5 db5ffee351494861de699f68b65f90d6
SHA1 efb0c221bd69e66a55e715cf9b3737f3aa21e454
SHA512 ea9fa806973b36a7ee32d3c09a4460420952e7641ee6e4effb5a9ed2c0ed7c34eec9dc6c7cf668ea8e9d85a4e65f464d556c8c381a84c034a7a502320f3f4272
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5
MD5 a26b0f78faa3881bb6307a944b096e91
SHA1 42b01830723bf07d14f3086fa83c4f74f5649368
SHA512 a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c
SSDEEP 1536:sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtQ:sAtWDDILJLovbicqOq3o+nQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1568-24-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/1568-23-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/1568-25-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/1568-26-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/1568-27-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/1568-28-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/3008-2-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/3008-1-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/3008-22-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/3008-0-0x0000000074692000-0x0000000074693000-memory.dmp

Download

memory/4860-9-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

memory/4860-18-0x0000000074690000-0x0000000074C41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads