metamorpherrat | eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe
Size 78KB
Sample240920-flft4azfpk
SHA256 eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351
MD5 8bdaf7ec0ba8800bae9540c903fa0e90
SHA1 a5150236f2785afd070065870b1d5f4a4043d3c2
SHA512 59c98c8093e37a84388497178451cd0e755cef2156adce3239600e8df221b97facad6a9030e15fda21ce8f7901fc9540d783c3584d2d9caec25371b52d82a585
SSDEEP 1536:nStHHM7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQteq9/e1+6:nStHshASyRxvhTzXPvCbW2Ueq9/W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe

Executes dropped EXE 1 IoCs

pid	Process
224	tmp6481.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp6481.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp6481.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe
Token: SeDebugPrivilege	224	tmp6481.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 600	1900	eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe	89
PID 1900 wrote to memory of 600	1900	eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe	89
PID 1900 wrote to memory of 600	1900	eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe	89
PID 600 wrote to memory of 2996	600	vbc.exe	91
PID 600 wrote to memory of 2996	600	vbc.exe	91
PID 600 wrote to memory of 2996	600	vbc.exe	91
PID 1900 wrote to memory of 224	1900	eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe	92
PID 1900 wrote to memory of 224	1900	eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe	92
PID 1900 wrote to memory of 224	1900	eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe	92

C:\Users\Admin\AppData\Local\Temp\eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe
"C:\Users\Admin\AppData\Local\Temp\eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sohglc9x.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6637.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC62CF066933343D19136E242829297EF.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2996
- C:\Users\Admin\AppData\Local\Temp\tmp6481.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp6481.tmp.exe" C:\Users\Admin\AppData\Local\Temp\eb4ea3d72fa1a897f7baf5d4cc7f4ed31428de48fce31081fcf049736291b351N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3924,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES6637.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6637.tmp
Size 1KB
SHA256 d9c3dfa619d146e3fe0afbb04809b08a19225891fcf9cc510d20662a02addd7a
MD5 9158440bfe8058065dd87044b10e00a0
SHA1 65ccce86b02aae95351378ade3e5650a4073d260
SHA512 4ef237ff5d64249a799d830fcc98d2b788f2ad39ae04a9f063af6a67ab21a68264550c6122d646c8d55b2944c46c2556e0868ab674c6057a70455eb210a31056
MD5 SHA1 SHA512

Submit Download

sohglc9x.0.vb

Path C:\Users\Admin\AppData\Local\Temp\sohglc9x.0.vb
Size 15KB
SHA256 c21e424d6d2868c3cfa2c04eec5f7743b777e4a02b7a9b9dce05685486b1f620
MD5 9f34640f9ff6fc4c739b748b9c62c935
SHA1 572db82c4ee88c84810cb0cb073a87eb2a7fafc8
SHA512 94d6cf8e3c793709647f56fc9e2cb893e7259111a593ccaa19cb265cbaf6c0bf7a35012b440cc2d584641d43b59976d2ef2c04ceb23b12bcc29b216f786ef8d6
SSDEEP 384:rONuHNSNyMSNK5WjxNBKN1cHbVE6NxzN7Q/SN7eP:Wi+AHBW1cHdxhG+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

sohglc9x.cmdline

Path C:\Users\Admin\AppData\Local\Temp\sohglc9x.cmdline
Size 266B
SHA256 aac71af3a03621313fa1d0e81993af4a6ee6372849b674b259cb064a6aea99c9
MD5 7ba6a57309881844a58e9861c4219582
SHA1 638de8e6b6b6a8fb8f537df85492dea0302eb5b6
SHA512 4bf09623c4a45a37d5a2cd53993859352264a2ee073eb32482f7034ac8109c87b0eb7625bcecc8da692f63f1a02aa22123fb58d53fc8a8ae25004f16c3c1a7b3
MD5 SHA1 SHA512

Submit Download

tmp6481.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp6481.tmp.exe
Size 78KB
SHA256 3ad895c2c23a5f7708afddd1fb0c9d7a006c93d49693215d86034b004f4a45d9
MD5 98d13594949e2fbbb7b01e90b03013cb
SHA1 0b8056e36bd12e1eb792c1ae9319dd5c951e0643
SHA512 1f74b15be43a8f646d7be4e34a032e66e23946fdc0b35d21eeebe158d4f002e78d13df71974554cd20306009ccb139f287dfe2a27c7bd8873aceff3f7e2b0b30
SSDEEP 1536:yc5MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96Y9/l1IG:yc50SyRxvhTzXPvCbW2Un9/T
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcC62CF066933343D19136E242829297EF.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcC62CF066933343D19136E242829297EF.TMP
Size 660B
SHA256 25b4345225687e902557d6d87faf63d80474a8574d43e2ef504620ec41cd367e
MD5 750c1d2b762c4918d4cce5211e75e51b
SHA1 d0d7382ceac702a6941810056f79063a73d2668d
SHA512 55b08b6df0c52753d900430c8438eb7b16d87ad38d3282a53ca038926720691a1095227db5986cc95fc586872c56a196e1bd975e57ea09f9f8f8cd6f404d76d0
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-23-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/224-24-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/224-26-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/224-27-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/224-28-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/600-8-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/600-18-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/1900-2-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/1900-1-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/1900-22-0x0000000074D60000-0x0000000075311000-memory.dmp

Download

memory/1900-0-0x0000000074D62000-0x0000000074D63000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads