metamorpherrat | a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe
Size 78KB
Sample240925-byltnaxarr
SHA256 a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4
MD5 2c1c65fc4b4f4ad4aa71b3fe28142210
SHA1 42c97c0a183096d4cc2b82df8c0eeccbda43bf26
SHA512 84918f1e9bd0d97f31224b9b7ffe89ae5267b1728b97ba73efc3c9e68db3db15ac42ef287e223b5535a842faa099851195071389120ab5b00dfa5a0cb42a0103
SSDEEP 1536:FtHFo6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt3H9/VX1+E:FtHFonhASyRxvhTzXPvCbW2U39/r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe

Deletes itself 1 IoCs

pid	Process
4444	tmpA23B.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4444	tmpA23B.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmpA23B.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA23B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe
Token: SeDebugPrivilege	4444	tmpA23B.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2492	4600	a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe	83
PID 4600 wrote to memory of 2492	4600	a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe	83
PID 4600 wrote to memory of 2492	4600	a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe	83
PID 2492 wrote to memory of 3792	2492	vbc.exe	85
PID 2492 wrote to memory of 3792	2492	vbc.exe	85
PID 2492 wrote to memory of 3792	2492	vbc.exe	85
PID 4600 wrote to memory of 4444	4600	a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe	86
PID 4600 wrote to memory of 4444	4600	a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe	86
PID 4600 wrote to memory of 4444	4600	a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe	86

C:\Users\Admin\AppData\Local\Temp\a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe
"C:\Users\Admin\AppData\Local\Temp\a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\okdslnbo.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA519.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1724D352DE224CB5B4267A0CBDA594B.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3792
- C:\Users\Admin\AppData\Local\Temp\tmpA23B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA23B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a2a892e31942da94a11a07b664c0595582aecf4978601f0dab6ed827f2fe43b4N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA519.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA519.tmp
Size 1KB
SHA256 e3a7a8ffff3d8714da7256114933d490082feb6f03d5c5db8e0edd833cf1571c
MD5 56fc9000b33c2759d33eeee6ef0c9ccf
SHA1 d6a42d3f028419dc3ba6a2b1ab71ffcb17ea13e7
SHA512 c216f9040be92e10e71cdfc11ae606dd91ae3aab47b2b1b8fb3718a72d94b4abe99d9f9f7a0a515e591356ba4c32f7270b0275b0ff0bdc6a7a3df31ed596f20f
MD5 SHA1 SHA512

Submit Download

okdslnbo.0.vb

Path C:\Users\Admin\AppData\Local\Temp\okdslnbo.0.vb
Size 15KB
SHA256 1bcb5a50aaf1391a78f3257117f131c820210a746f8348cd172b6abd8ab1fdc0
MD5 5e96b89f552e0b16ba0a9bdaa20d4374
SHA1 4ff56a202b9969c7ce37f5457d9f524a71fab161
SHA512 7ca947763969baf707b9f4169538e24a0aa39da588d60da7fd9fd4b5f1be640440b5694e3a4d7b65ec36c3bc5d076bdc18f240f986b5a2818f81a7b4c34bff7e
SSDEEP 384:r7NWqN2aN9NOT9uNwN9cHbUE6N5zN7Q0SN7eP:Fv2GvmC49cHM5hh+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

okdslnbo.cmdline

Path C:\Users\Admin\AppData\Local\Temp\okdslnbo.cmdline
Size 266B
SHA256 e43bb9963b6e532949f15f95bb283995ded7ededd03796a0c43f9261ef88d977
MD5 647cdfa9a71e86ea7e870a903c5aeca4
SHA1 af3793e70e2884c0baadaffc48b8e4f60d34b0ad
SHA512 22f3d437dd93d010d20d18e4eae3a8275782b0b824793db348d5eba1f199a39ceb79bff86c0008e2c1159e71a60d5ad8612ac26a50d341269f186d20278baaa2
MD5 SHA1 SHA512

Submit Download

tmpA23B.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpA23B.tmp.exe
Size 78KB
SHA256 dd6b5daaa4924301d9cd2518528e0975937280668f6cba893b53972400157c66
MD5 ae3fbb758ace83a832d3d9105b92cd65
SHA1 a490c52be99c7b86a85fe80e60fd8f6c96461ca8
SHA512 6acd42d14b7ddb1cc74d0b3cd19e1a429f9732d0099722e5a40dcdbbca28cf1e925333e4b942e77bd513d41190853e222e5bde87e7a372bbf8a015c930f21285
SSDEEP 1536:/y5jSzXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6L9/DU1l/:/y5jSjSyRxvhTzXPvCbW2Uj9/Dg
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc1724D352DE224CB5B4267A0CBDA594B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1724D352DE224CB5B4267A0CBDA594B.TMP
Size 660B
SHA256 12ba724948048b53a10e425c804d237772905ec8bfce033de3f6d37cb9d3a2ee
MD5 9c82bafac4e52880fcc19edb367ac39e
SHA1 f31408f9142737d0c3b918e6d3b845f79f352c41
SHA512 fea66a047abe85ea967ea01dabb3f34b892beeb1ee23191cd14b8f58125d3630fc406854783c40f23ccb0eacca18154fde1c3de774fc408eb0ba38f3333f7842
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2492-9-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/2492-18-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4444-23-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4444-24-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4444-26-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4444-27-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4444-28-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4600-2-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4600-0-0x0000000074E12000-0x0000000074E13000-memory.dmp

Download

memory/4600-1-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4600-22-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads