metamorpherrat | 86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2f

General

Target

86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe
Size

78KB
MD5

eb26f7f2335a2239eaf496c42f0306f0
SHA1

e9debffb6f57de27d125c28f79aa552f635633b2
SHA256

86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2f
SHA512

b910ba53e668174a11f0b9a8bc49a5bcb6683751c95b46706fa352d417a093f5ea9a6f6d2d673162bdf38aae046327ab255c6ad13e9c915e46786cdba5c3bd11
SSDEEP

1536:chPWV5rXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt96v9/Hm1ab:gPWV5rSyRxvY3md+dWWZyk9/X

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2404	tmp8E6A.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe
2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\""	tmp8E6A.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8E6A.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe
Token: SeDebugPrivilege	2404	tmp8E6A.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2884	2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe	28
PID 2152 wrote to memory of 2884	2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe	28
PID 2152 wrote to memory of 2884	2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe	28
PID 2152 wrote to memory of 2884	2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe	28
PID 2884 wrote to memory of 1756	2884	vbc.exe	30
PID 2884 wrote to memory of 1756	2884	vbc.exe	30
PID 2884 wrote to memory of 1756	2884	vbc.exe	30
PID 2884 wrote to memory of 1756	2884	vbc.exe	30
PID 2152 wrote to memory of 2404	2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe	31
PID 2152 wrote to memory of 2404	2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe	31
PID 2152 wrote to memory of 2404	2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe	31
PID 2152 wrote to memory of 2404	2152	86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe	31

C:\Users\Admin\AppData\Local\Temp\86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe
"C:\Users\Admin\AppData\Local\Temp\86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\omhfkyng.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F07.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8F06.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1756
- C:\Users\Admin\AppData\Local\Temp\tmp8E6A.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8E6A.tmp.exe" C:\Users\Admin\AppData\Local\Temp\86add3aec0b2b8e9ccfccc0580c3cc7072db041c5888a0f7bc4773af6beb6f2fN.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES8F07.tmp

Filesize
1KB

MD5
33fd163212a1d550e7a4c8e85443ba27

SHA1
5b789991e4a399ed65e349d41297b72fc6289356

SHA256
bdab50396f9e73e59620f2a6e790e163ce59147c029cd12533dc63e615730a9d

SHA512
8e31866c1108e0f88046795235be5a36807b443297b42db49b8722be578c62e58f41be6ecae67834970df939b6165e575caee44be73856ec550409e8fd277419

Download Submit
C:\Users\Admin\AppData\Local\Temp\omhfkyng.0.vb

Filesize
14KB

MD5
a0946f4c66b0e36ba8323a490fc42b82

SHA1
09bc2e6754048bc694ec2a3150df1f5a6a13df9e

SHA256
e2341fa5833d8b6a2877008debd6f70eed4cc4abb1698acbc2f87e1793523064

SHA512
d478f91c1bb8f31f5fa43d0e3122325af49231262692428352d0a9b8f536942df318cce8dc2c637cbf829df13726b1c54c9e4cd90d44b2fe41010ae153b38e18

Download Submit
C:\Users\Admin\AppData\Local\Temp\omhfkyng.cmdline

Filesize
266B

MD5
3b91e615e66aefb7d9b58f2061e4bcd0

SHA1
102b85099e39dda0e0a1602ca1153d552c23b547

SHA256
3ee87b133c8a1e648b716a84d3dba4d2156c69b075898964cd50f2a747e0e130

SHA512
19a6ad93508245a2e07fc230c8bbbb6b75e9369d69017f1f723d40958e0f91b3e2cdf3d7ade990e2c62acf46f18691ef5b74cd070a914ef79d9162035dea6f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8E6A.tmp.exe

Filesize
78KB

MD5
4d2976bb8040929e3d98ca04f425bd72

SHA1
0c6ef69475b25ceae906212a8d066f4fcd30dcb0

SHA256
c93da2b56c22c1be2651a39ccf587164ce9802ef4a07bc2883aece063937a679

SHA512
9f13fed5fc2c171ec112917f9b09622ca3477aa270284c54d10a293c7f2215bc091071b06f54769a9da20ccde5570104556355baae6afea1bb8e1b3abec1bb6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc8F06.tmp

Filesize
660B

MD5
f567cce456815ec30cf746f88aa53148

SHA1
b158aca72fa23bd1db23de85f297a247189189c2

SHA256
9bfcb3e8791b2f0616903513df3b28e6ef64dee724fc174f15a174e99ecd6070

SHA512
6ec9dd60504aa045bb0708d15545f2d774a64ba94243644d174580ac6c1c6d4ad9961acbba3e9bf27d09afc1a1cb9dfb9c742db5964b5a769065cbc8b602a151

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
4f0e8cf79edb6cd381474b21cabfdf4a

SHA1
7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4

SHA256
e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5

SHA512
2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107

Download Submit
memory/2152-0-0x00000000748D1000-0x00000000748D2000-memory.dmp

Filesize
4KB

Download
memory/2152-1-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/2152-2-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/2152-24-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/2884-8-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download
memory/2884-18-0x00000000748D0000-0x0000000074E7B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads