metamorpherrat | 1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe
Size 78KB
Sample240921-tkatca1cke
SHA256 1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305
MD5 39e861c10ee19a6b7290154a4d98dcf0
SHA1 cce5b1b97dd5622e0bd45d57a7a602caa6d341c0
SHA512 916f7eac4df8480ea9ef8a9ce61a24c49a2836f38018fbf95f1dc229ae06b3918af839c6c9798a20f5131b7ff1768379751b9adc450e5def8ca2163abf3eea61
SSDEEP 1536:ORWtHFo6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtcD9/P1jA:ORWtHFonhASyRxvhTzXPvCbW2UcD9/W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe

Executes dropped EXE 1 IoCs

pid	Process
1516	tmp9C30.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp9C30.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9C30.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe
Token: SeDebugPrivilege	1516	tmp9C30.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 628	4976	1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe	82
PID 4976 wrote to memory of 628	4976	1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe	82
PID 4976 wrote to memory of 628	4976	1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe	82
PID 628 wrote to memory of 3184	628	vbc.exe	84
PID 628 wrote to memory of 3184	628	vbc.exe	84
PID 628 wrote to memory of 3184	628	vbc.exe	84
PID 4976 wrote to memory of 1516	4976	1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe	85
PID 4976 wrote to memory of 1516	4976	1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe	85
PID 4976 wrote to memory of 1516	4976	1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe	85

C:\Users\Admin\AppData\Local\Temp\1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe
"C:\Users\Admin\AppData\Local\Temp\1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\odm3s52_.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D2A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc26C5936B2E594BFA9F9E709C5EEFFFD9.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3184
- C:\Users\Admin\AppData\Local\Temp\tmp9C30.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9C30.tmp.exe" C:\Users\Admin\AppData\Local\Temp\1adcacda47ac8b7bb684fd4b0d721f626c83d835e11b0ddcfe1128de26dbb305N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9D2A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9D2A.tmp
Size 1KB
SHA256 c3fed92bc9ad7715f39ab9497010335fd04b163ef8acd7a137c8ecbc3a3823a6
MD5 83f16181f15cf1abbf6a44a7849d92aa
SHA1 c9d10ca311856d3057cd052eb839cc793cd57129
SHA512 0b671991f7bd5fac6290ae375593d49e3b23113933435d861a09bba570f9723f74d2bb27845433df0f2bc20d73830ed4b19ac9d10ab4d0cf1e7f1013a8013cef
MD5 SHA1 SHA512

Submit Download

odm3s52_.0.vb

Path C:\Users\Admin\AppData\Local\Temp\odm3s52_.0.vb
Size 15KB
SHA256 11d57304aa55c1c72d40da8002358725172be03747f389f07796e1e71c243a76
MD5 16053c00442bc6f2e16955e4117a560f
SHA1 a74adbf35e49f5c1433d2f6c02005b51aa7af98f
SHA512 81a587b76cf87e248aa58f63833439c8b1df2f5a57744d15cd1b4711c5910a2624c778b8b85426ebd724b91854ea1290ac23c0e63728828f6862d084c96a239c
SSDEEP 384:rZN3NSNwN/wRsnzRNdNIcHbRE6NKzN7QUSN7eP:X9+4HrPIcH5KhJ+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

odm3s52_.cmdline

Path C:\Users\Admin\AppData\Local\Temp\odm3s52_.cmdline
Size 266B
SHA256 68f28ff79e5fcc211c0e47b2fdc3ed9a12d35c1fb5df1ce89c66baf0d7ac3a41
MD5 59a0f4f68bf52a573a594758e394c72e
SHA1 a5a13485d79c6752467c4e32b5fa96dabcfa81a7
SHA512 7a0eae5ab99b9ff8ec5db90f001af671ab88b2c5944f107a5378f25d7c575021b7efb6f893ae977e07041219e02e87ea07aa58bf775c3514b27a3c3367c9cb8f
MD5 SHA1 SHA512

Submit Download

tmp9C30.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp9C30.tmp.exe
Size 78KB
SHA256 d9ee60e36a378a97bd4a3c3d0cb74d0e62348434a49cbe45c209ac328596444e
MD5 2c2c9a6ff7378c04f160f559356b8b2a
SHA1 2f73f4a731d2996207429e0b7744539564963eeb
SHA512 9371605af288afd729c0eb0e6bc28479ce0501abc04244dade93401437b9302ddc4da90246569770819cffb7956a410d7a401735816e47740e974e7241a12689
SSDEEP 1536:E58VXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96u9/6817Q:E58VSyRxvhTzXPvCbW2UN9/K
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc26C5936B2E594BFA9F9E709C5EEFFFD9.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc26C5936B2E594BFA9F9E709C5EEFFFD9.TMP
Size 660B
SHA256 2b0cb087b81fdc67a317d7abaf52b4b74e5b4abbb777ae3a068159a6165699cc
MD5 adcecd520bbd09726db6d327b5c5945a
SHA1 ea3f2c36e1095a799473947823bf8c918cde78ac
SHA512 502e943f4c849bc541b6ce8557615d4e65937ab2ab7a8d1eda61c11e946ccab46c920cc0bfb3ccfbb5dda68d61afbfbc8a72d706520c51269db02df8d589eee8
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-8-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/628-18-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/1516-23-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/1516-24-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/1516-26-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/1516-27-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/1516-28-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/4976-0-0x0000000075022000-0x0000000075023000-memory.dmp

Download

memory/4976-2-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/4976-1-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

memory/4976-22-0x0000000075020000-0x00000000755D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads