metamorpherrat | 22f0ab8a4c6ab2479f6b7d2e7061404cedd344377a41f06bfb5c247aadc3cd00

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18a26b26496327a38ec522546064728c_JaffaCakes118.exe
Size 78KB
Sample241006-srcqvavfnb
SHA256 22f0ab8a4c6ab2479f6b7d2e7061404cedd344377a41f06bfb5c247aadc3cd00
MD5 18a26b26496327a38ec522546064728c
SHA1 f8d221536a963ffe18bb8755a5b706978a693969
SHA512 2dae0366d9e4e88f61265db1354eb654cf31615af5f568f90be45cfa528971fc7cfc21bc0096db558444c60473045e71ed8203bd1a738606a014de801bd85e2c
SSDEEP 1536:GStHHJIdXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQt8O9/041je:GStHpINSyRxvHF5vCbxwpI6W8O9/07
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	18a26b26496327a38ec522546064728c_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1504	tmpA1AE.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1504	tmpA1AE.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_perf2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mscordbi.exe\""	tmpA1AE.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA1AE.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18a26b26496327a38ec522546064728c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	18a26b26496327a38ec522546064728c_JaffaCakes118.exe
Token: SeDebugPrivilege	1504	tmpA1AE.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 4680	2724	18a26b26496327a38ec522546064728c_JaffaCakes118.exe	82
PID 2724 wrote to memory of 4680	2724	18a26b26496327a38ec522546064728c_JaffaCakes118.exe	82
PID 2724 wrote to memory of 4680	2724	18a26b26496327a38ec522546064728c_JaffaCakes118.exe	82
PID 4680 wrote to memory of 3892	4680	vbc.exe	84
PID 4680 wrote to memory of 3892	4680	vbc.exe	84
PID 4680 wrote to memory of 3892	4680	vbc.exe	84
PID 2724 wrote to memory of 1504	2724	18a26b26496327a38ec522546064728c_JaffaCakes118.exe	85
PID 2724 wrote to memory of 1504	2724	18a26b26496327a38ec522546064728c_JaffaCakes118.exe	85
PID 2724 wrote to memory of 1504	2724	18a26b26496327a38ec522546064728c_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\18a26b26496327a38ec522546064728c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18a26b26496327a38ec522546064728c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eup8scft.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA335.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7926BF16353A45EDB73CFD87B1F27D2A.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
- C:\Users\Admin\AppData\Local\Temp\tmpA1AE.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA1AE.tmp.exe" C:\Users\Admin\AppData\Local\Temp\18a26b26496327a38ec522546064728c_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA335.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA335.tmp
Size 1KB
SHA256 15f789b5b52b4837c830b63a2782724e26fedba7eff25c2e99d5b5b09253ff21
MD5 17f45df3892fe9811c1c256d3b904451
SHA1 5886a8d1b5a8b405b2c3aa7ecee4c440450c21ae
SHA512 fe76c197ab764b53dff825394593133b8ed2085c3463b47205a4131bdbc75dc05711d914e75ae4a2848b23762e88923e7bdf30890c47903e68d955760e088800
MD5 SHA1 SHA512

Submit Download

eup8scft.0.vb

Path C:\Users\Admin\AppData\Local\Temp\eup8scft.0.vb
Size 15KB
SHA256 041f579cc9337cef4bdad8c82912acfc4a8316ec1369de09c0d52c180fae9a8b
MD5 cf74d9b46552a0b7ba446563bf2d43a0
SHA1 5eeaf0952ff6b1a56e8880d995afa79322102246
SHA512 1087c454d22ba74d5bef9ac22981bed7bd25aea6a2237eee12f29b4dff56c1442b994f564d809668fd3351418e3f861754fcaedf8f9dd3db673502838c8f7372
SSDEEP 384:rjXNwNSNZNKhyrNrN9cHbfE6NVzN7QLSN7eP:fd4+zrZ9cHfVhO+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

eup8scft.cmdline

Path C:\Users\Admin\AppData\Local\Temp\eup8scft.cmdline
Size 266B
SHA256 9ad5d6a3d0041aa1e85ae01bc631439eb6940975bfa2738a481d610021a6f3f6
MD5 8dc94746052c9e593575027006843c6b
SHA1 92f62143665f5539ee6447e77f084a58a67a2a68
SHA512 17a3911d14540887cd2bfc1e44084558dd7fb343273bcdfce397e821ce25ad0bb3a5f16cf481a9a757ae28df24c772c820f66b49154a7aea42c8b44958e141aa
MD5 SHA1 SHA512

Submit Download

tmpA1AE.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpA1AE.tmp.exe
Size 78KB
SHA256 b9c6e54cb787aacd46e683381fe87988494e437f188b17e87b44c782a905ffb3
MD5 ccc50333698c8c627ca240046c890c37
SHA1 fcd6e82012c1e9d55258d471adfde29cc709a3bd
SHA512 d1157f9ef6c2f3105f856d0e116ea270e2b2e6efab38a3f8a08db53430292f3a4fe3ce75865f44ebc3b271aa8b7a85054b2c62a05d1cecbe36f3c9bf5dca7560
SSDEEP 1536:eRWV58EXT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtd6S9/r1ai:eRWV588SyRxvHF5vCbxwpI6WV9/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc7926BF16353A45EDB73CFD87B1F27D2A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc7926BF16353A45EDB73CFD87B1F27D2A.TMP
Size 660B
SHA256 a9c14b2f2f99af9701743ca387e7c21167ebfc7a19f71f7677d1a3353182ae03
MD5 93ff47a7f15810216a1bd3f9ec42fd47
SHA1 086840181f9300f3c6f42cb4c94326a9e3c89451
SHA512 d9246c1e4493aa4b39205f99972f053a180404c7aa320f68be950d38b45578c3553603cc3564257c0ac75e27d9c94703ca65117bb283019c39cfb44a7ffaa8f0
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 e2eb52524ddfed5e52a54484b3fecdc9ebe24fb141d1445d37c99c0ab615df4f
MD5 097dd7d3902f824a3960ad33401b539f
SHA1 4e5c80de6a0886a8b02592a0c980b2bc2d9a4a8f
SHA512 bb77c3f7b9b8c461b149f540a0dab99fdde474484b046d663228d8c0f1b6a20b72892643935069dd74134c8ab8e8f26b6badc210a6929a737541b9861007fbe4
SSDEEP 1536:0XT0XRhyRjVf3HaXOJR0zcEIvCZ1xjs9np/IPioYJbQtQ:sSyRxvHF5vCbxwpI6WQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1504-23-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/1504-24-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/1504-26-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/1504-27-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/1504-28-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/1504-29-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/1504-30-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/2724-2-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/2724-1-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/2724-22-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/2724-0-0x0000000074DD2000-0x0000000074DD3000-memory.dmp

Download

memory/4680-8-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/4680-18-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads