metamorpherrat | f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091

General

Target

f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe
Size

78KB
MD5

ae4e95fbc9c599bbc51026a16ce01130
SHA1

28dcdbbd6d771345d0afb996c2818f133bc04497
SHA256

f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091
SHA512

d43b3b6aa22f8bc0efd9930e654d9f21b5c3e0a09c6a0b4812285679e0e48c18ec69e147b70ecd572d407c4d6ef1c52dee296329f221b6375eaa1d77fcf5507d
SSDEEP

1536:DXRWV5sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6SM9/v1zm:zRWV5sAtWDDILJLovbicqOq3o+nD9/s

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe

Deletes itself 1 IoCs

pid	Process
2400	tmpA75C.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
2400	tmpA75C.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmpA75C.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA75C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe
Token: SeDebugPrivilege	2400	tmpA75C.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3240	2288	f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe	82
PID 2288 wrote to memory of 3240	2288	f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe	82
PID 2288 wrote to memory of 3240	2288	f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe	82
PID 3240 wrote to memory of 4736	3240	vbc.exe	84
PID 3240 wrote to memory of 4736	3240	vbc.exe	84
PID 3240 wrote to memory of 4736	3240	vbc.exe	84
PID 2288 wrote to memory of 2400	2288	f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe	85
PID 2288 wrote to memory of 2400	2288	f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe	85
PID 2288 wrote to memory of 2400	2288	f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe	85

C:\Users\Admin\AppData\Local\Temp\f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe
"C:\Users\Admin\AppData\Local\Temp\f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\imrhimp4.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA921.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9E252C43CFF5482BB56829EB70C76672.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4736
- C:\Users\Admin\AppData\Local\Temp\tmpA75C.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA75C.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f10b5317e6ff77ed1d5d8a11035685e4ee56d15590fd531242c6260d4384e091N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1

T1064

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESA921.tmp

Filesize
1KB

MD5
403481a10244f1e59ce937f40a951b1e

SHA1
8a0f53e3514e2473c8c6f3ab7eedfa4a7e8156b6

SHA256
1e44181f4b7c98e5291ac6c5942740087ba31684636420a410b4c3c8d19843de

SHA512
1a06cbb25a7cd2d9e4d7ef8b4f8ad9918d9316f312a005ad178bacb41a5ad6ebfbf8cb8e14a03b62529daf930b21d359f56ecaa62c2843ab97f3967da2dbcf8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\imrhimp4.0.vb

Filesize
14KB

MD5
70208525815a22e730b09f5d7bcc2255

SHA1
29ef0b6a88ff401e283856f82c417658c7678543

SHA256
acc2daf299241de1e0b69a34567b4bd5ba70a4a0729aeb63f5c4c6d3fb822721

SHA512
9ac58d7c1cbe3a722dec003b22256cce0b376e6713053b7378a3b2256c5f5f6052f037f14a70f30438f30cf1342799971c98952a99c31890597199a1ac93ce01

Download Submit
C:\Users\Admin\AppData\Local\Temp\imrhimp4.cmdline

Filesize
266B

MD5
525a8c05d6de88acbb9820b9f889743e

SHA1
a687f2c77a976f07f207ff0f1ba93b380d03bd4f

SHA256
2ddb9853e80d6201bed729a036f8705367c3a1ac020dba48e377aedc915cd250

SHA512
d973328b39c3bc576cbd0ec6ab65e29b004f2ec1e25cf70c9f1ddeb3cc81cf211f3f61db0260fbd47c60ac3ea448213b75507362b09626fcadd46f78b7addeaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA75C.tmp.exe

Filesize
78KB

MD5
d24db21f88e9835a799896e80b970602

SHA1
c7202bd5e4ab15b6f5fc6e1c89a7ec49711449e5

SHA256
606b6fcd60b53f3eafdba81b2a9be8568c81e556c63d7ab8a2755a1c9ebac699

SHA512
5240c5575b4b0c380059ac473e05d94855de0cfbea07060a4da0d8cc6afbdd6d4bf20546d5eb0d4d5c37ab142772ecf92b255e5b20cdb893d16b9cee70a06a2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc9E252C43CFF5482BB56829EB70C76672.TMP

Filesize
660B

MD5
185383e69906899a31e7976053622060

SHA1
eaae74973e0d7ad844d4889f7af2d060f801670f

SHA256
20a515a64262cc029c66233b19de144eca78323e72354f4eeef62bb9c8e061d9

SHA512
7dac9b6743a481eb860617f1104552a0c148a6f7abfbb10e316bfc12d828f22a7250185eaaf0b27eaa08228fa6acdb8b0b901c608bc3d2bcab23594076b2754f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
a26b0f78faa3881bb6307a944b096e91

SHA1
42b01830723bf07d14f3086fa83c4f74f5649368

SHA256
b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5

SHA512
a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c

Download Submit
memory/2288-22-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2288-2-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2288-1-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2288-0-0x00000000749B2000-0x00000000749B3000-memory.dmp

Filesize
4KB

Download
memory/2400-23-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2400-25-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2400-24-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2400-26-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2400-27-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/2400-28-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/3240-9-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download
memory/3240-18-0x00000000749B0000-0x0000000074F61000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads