metamorpherrat | def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe
Size 78KB
Sample241008-eafjhsxcrj
SHA256 def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e
MD5 cc94c181742ef5fa9c0b81f11c26b1af
SHA1 462b0760cad3761776eab20fd59e35844d103ee9
SHA512 a15173f9385a1da5b5f72dd1da725aa92556caf784636e5870e6264a35496a177d326d718792a435fb6ca6240292815acd5e4415358bfe29caf2363093407fca
SSDEEP 1536:MRy5jIXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtN609/i1k/:MRy5jQSyRxvhTzXPvCbW2U79/Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe

Deletes itself 1 IoCs

pid	Process
3688	tmpCCE5.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3688	tmpCCE5.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmpCCE5.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpCCE5.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe
Token: SeDebugPrivilege	3688	tmpCCE5.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2612	4308	def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe	85
PID 4308 wrote to memory of 2612	4308	def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe	85
PID 4308 wrote to memory of 2612	4308	def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe	85
PID 2612 wrote to memory of 8	2612	vbc.exe	87
PID 2612 wrote to memory of 8	2612	vbc.exe	87
PID 2612 wrote to memory of 8	2612	vbc.exe	87
PID 4308 wrote to memory of 3688	4308	def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe	88
PID 4308 wrote to memory of 3688	4308	def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe	88
PID 4308 wrote to memory of 3688	4308	def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe	88

C:\Users\Admin\AppData\Local\Temp\def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe
"C:\Users\Admin\AppData\Local\Temp\def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\petwkf6x.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEAA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF762E52D5DC2458D8072D0FAE521CC.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8
- C:\Users\Admin\AppData\Local\Temp\tmpCCE5.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpCCE5.tmp.exe" C:\Users\Admin\AppData\Local\Temp\def720a02e55e8ff8aa11267da8be2ac332a17b8cb3cd8845d445dc60b90a09e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESCEAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCEAA.tmp
Size 1KB
SHA256 d9aab300570b0aafbdb5df492fae4e901d0c74887caf4f4e27b19f1bc0dfbf33
MD5 57b6b3d58364f43fbdfe9ae589c56a40
SHA1 e3c02a2438cee19b47d0f8b66f1c864891fff36f
SHA512 e1c35a721c222eaf1e2a225734dc5f8404bce1250967dee98c43c96f6e35a69a5aa7224195ab3bb292e8c2caa7f83237b98b4655fa2cc2ccf7167075103af160
MD5 SHA1 SHA512

Submit Download

petwkf6x.0.vb

Path C:\Users\Admin\AppData\Local\Temp\petwkf6x.0.vb
Size 14KB
SHA256 11c10f9ffa59971907e1230b2fc9f041f43e195ee8dd42f1d424032eed4c6860
MD5 ace0debf3463c316bccc4fc343fcae4b
SHA1 3eb8b482ed234bf0276b13723ca8077ff0f22c0d
SHA512 b65cc1f383ba64f8abfb559e985fd746274b691fedafecad04df8adf80ec942fca66c5087255c16b14b922251b1771f1866b02fdad32eeb081faf05417e13213
SSDEEP 384:rBSNLNFNBuXJN1cgckFzhsNENScHb4E6NUzN7QPSN7eP:d+53ID1LIkScHQUhE+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

petwkf6x.cmdline

Path C:\Users\Admin\AppData\Local\Temp\petwkf6x.cmdline
Size 266B
SHA256 a6325bd79f1864697952ad49ba5b81af4539e8d3630bfd5f1faead8857fc3052
MD5 f56fd50d030518a26bad29cac68e420a
SHA1 703a0997e8267a69100db46e0177ee906b5d5a25
SHA512 a48d48378d7e8caec2c1a44b73e32c68646698ce3672063b90fb2d4eba51b9d2edc190a97f9af5a1217cdd820ada6aa0993a12e675b04496fcfe1db43d1c050d
MD5 SHA1 SHA512

Submit Download

tmpCCE5.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpCCE5.tmp.exe
Size 78KB
SHA256 a37000db7b20593ac167cf61b8f2e0516268a1ea7847b36b1c316f45d1bce6d7
MD5 1055fdba5a4bb55141bfec88d1abfa06
SHA1 d74bdb689e6ade7ca55a42e4a9711a5d765325f2
SHA512 c61c30e0a6cfedc84e71bc0dc0f64f8e6a6e56cc125c112259b6c4b333b44125ceab8e6f0a500e59f73178b3bfacb27bd678ded7aa44d29658cbf167b7a01c65
SSDEEP 1536:gPCHY6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtp9/61RK:gPCHYnhASyRxvhTzXPvCbW2Up9/T
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbcF762E52D5DC2458D8072D0FAE521CC.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcF762E52D5DC2458D8072D0FAE521CC.TMP
Size 660B
SHA256 c0465900a77ba8136a65fbfb375a0bd94c3a97ae8de35d18dc8e29729d2f9c57
MD5 f8fc3bbfeb5e0226ca341ae0cbd52e21
SHA1 95bec8def1e6290aedcf7777debdad4a492d671a
SHA512 63eb986b045a0be38ff74503a2057461b6c2742674cb35fb20a3b0f56889f34856391dde405809544094b5990eda1be442e200e5d4c6d1c94e51c4cd0402b4ff
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7
MD5 8fd8e054ba10661e530e54511658ac20
SHA1 72911622012ddf68f95c1e1424894ecb4442e6fd
SHA512 c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c
SSDEEP 1536:MXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtQ:0SyRxvhTzXPvCbW2UQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2612-18-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/2612-9-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/3688-22-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/3688-24-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/3688-25-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/3688-27-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/3688-28-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/3688-29-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/3688-30-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/4308-2-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/4308-1-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

memory/4308-0-0x0000000074F42000-0x0000000074F43000-memory.dmp

Download

memory/4308-23-0x0000000074F40000-0x00000000754F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads