metamorpherrat | e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe
Size 78KB
Sample240923-cw2b1atemf
SHA256 e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090
MD5 2a9de5103cd7937e5db367cec8bbc5bf
SHA1 5264df397b1bd818fe4e4fa659988c13f88be991
SHA512 d4acb8be6a6f4d401078d7ae3085577262f51c82c2639def34281e0c412d8f911fff6a2f3a7df33cf60d3b2278cf530c6da5dedc11c1255e11a42a868c7afad6
SSDEEP 1536:IPy5j4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt9609/wa1yg:IPy5jASyRxvhTzXPvCbW2UX9/z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe

Deletes itself 1 IoCs

pid	Process
1012	tmpBFB6.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1012	tmpBFB6.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmpBFB6.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpBFB6.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe
Token: SeDebugPrivilege	1012	tmpBFB6.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2292	3968	e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe	82
PID 3968 wrote to memory of 2292	3968	e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe	82
PID 3968 wrote to memory of 2292	3968	e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe	82
PID 2292 wrote to memory of 3632	2292	vbc.exe	84
PID 2292 wrote to memory of 3632	2292	vbc.exe	84
PID 2292 wrote to memory of 3632	2292	vbc.exe	84
PID 3968 wrote to memory of 1012	3968	e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe	85
PID 3968 wrote to memory of 1012	3968	e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe	85
PID 3968 wrote to memory of 1012	3968	e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe	85

C:\Users\Admin\AppData\Local\Temp\e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe
"C:\Users\Admin\AppData\Local\Temp\e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r_lpzvur.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC19A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc792611118F714A4DA928AC7EBC5720DE.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3632
- C:\Users\Admin\AppData\Local\Temp\tmpBFB6.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpBFB6.tmp.exe" C:\Users\Admin\AppData\Local\Temp\e61fb60578d9d8e32892495e016500266b28d8f2683bc3355b43346656569090.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC19A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC19A.tmp
Size 1KB
SHA256 0116fb5e4663a067417bf0e8c27aef80a43502909f2aa05c3805c4406e1c0932
MD5 373ea4b8a2010743836ec274dbf68dce
SHA1 4a7aa411b7f8855a826470afa8aa7627054d8f71
SHA512 a9c37251c608ef7af3316d0f22d467a26a0bdaad467d6f83f3e91f6032d9f467b75fb7911fac335cdfe24e37f0c51d25ce1612786f75f2b09dc6e35f93a56c80
MD5 SHA1 SHA512

Submit Download

r_lpzvur.0.vb

Path C:\Users\Admin\AppData\Local\Temp\r_lpzvur.0.vb
Size 14KB
SHA256 4c4d9cc14813871d59b2fe464d2d99d221771ced31580e435ecfb011ceca0e80
MD5 9851aff458e33590e71fb09abfe97e93
SHA1 9dc6f9242b67d08a6f3b9bdb5eba62cebba51774
SHA512 bceb279dc8efef2f0fb2c101f2c28bda360db1528226f3ab7d1f06f30fd4a0d492118405efb709a2020fc1539e42425e1431b71947588006d4c3df527c88788b
SSDEEP 384:rBNNqNBKPNmzNygckFzefNiDNDcHb4E6NUzN7QPSN7eP:df2BAwhElUDcHQUhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

r_lpzvur.cmdline

Path C:\Users\Admin\AppData\Local\Temp\r_lpzvur.cmdline
Size 266B
SHA256 23de45a4f1b5f3929154ed60ebf3d64cdcabe0785f2b45c73f2a223ba28135ee
MD5 fccbe68213d731b2acc6ccf8b63202b2
SHA1 92ba3dd21791d86e18e8160092405a9da9139815
SHA512 82f1740acc4e06a4d10ab4307a8bbb6bf434f034d1a3828b2bce49ecea9c63774fcb2192b44b4581e573aec216b870684a9b9be02b699f9539281a6822cbb109
MD5 SHA1 SHA512

Submit Download

tmpBFB6.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpBFB6.tmp.exe
Size 78KB
SHA256 3afa6667e36a18aa545167320505bba0473d195065c59e9806a086e72b555aec
MD5 dbfc1ac39ef9808176cb4cc294c861ff
SHA1 0cf916664bf8aebbea174e34aaf89fbb6d5063cf
SHA512 5485ea8c6514ca2e6d2d273cd82c67a0aa5c97e5702e3affdde1214ec7e26e99da354b5f921cd6fa8f4451f142df3ce8de9d6fee98dcc72c92e62b5760cd4718
SSDEEP 1536:uCHFo6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt59/B1GK:uCHFonhASyRxvhTzXPvCbW2U59/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc792611118F714A4DA928AC7EBC5720DE.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc792611118F714A4DA928AC7EBC5720DE.TMP
Size 660B
SHA256 bf325084b67bf5ec8755dc57ad7dcc03a41ec8a0a8b51104700ed80e4988bea7
MD5 5ba9f4cbc96ba3097d284292d045c7da
SHA1 3ef23512a501a43dd06dd40922d88f57b3385b80
SHA512 6aacf2ef01bde92e95dacb5df3d2a60f95efdfb9c540a08f1ac8df4475e945d9f99df5b213f99da1636034aea69299275c6da7ecc7a5c02e9470e0e350992dd3
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1012-23-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/1012-28-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/1012-27-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/1012-26-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/1012-24-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/2292-9-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/2292-18-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/3968-22-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/3968-1-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/3968-2-0x0000000075560000-0x0000000075B11000-memory.dmp

Download

memory/3968-0-0x0000000075562000-0x0000000075563000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads