metamorpherrat | 5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34

General

Target

5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe
Size

78KB
MD5

b2a5489877f58a7ee049569cff6e3270
SHA1

f60d1d08fa723a3d24b4b87414cca62dd82a0437
SHA256

5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34
SHA512

5ea40c1c1c173bff711523979836057a27076dcdc715806937fccb2a56b9e702e6213e27939d18f3225b643fba35bce33a8c99f3ea2df40c08069f27bc77eee1
SSDEEP

1536:psHY6JJteVdv5wyFppaVs+aYTCgtWzYXxxiMrBnP5oYZNQtP9/91Tc:psHYO3e/vqyA11XYUBxprBPjcP9/4

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe

Executes dropped EXE 1 IoCs

pid	Process
3144	tmp8C42.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System.Management = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sbscmp20_mscorlib.exe\""	tmp8C42.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8C42.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe
Token: SeDebugPrivilege	3144	tmp8C42.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 3424	936	5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe	84
PID 936 wrote to memory of 3424	936	5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe	84
PID 936 wrote to memory of 3424	936	5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe	84
PID 3424 wrote to memory of 1444	3424	vbc.exe	88
PID 3424 wrote to memory of 1444	3424	vbc.exe	88
PID 3424 wrote to memory of 1444	3424	vbc.exe	88
PID 936 wrote to memory of 3144	936	5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe	90
PID 936 wrote to memory of 3144	936	5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe	90
PID 936 wrote to memory of 3144	936	5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe	90

C:\Users\Admin\AppData\Local\Temp\5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe
"C:\Users\Admin\AppData\Local\Temp\5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kbs2aguc.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D4C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1997DDB6EFDC4623ABEF635B44836627.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1444
- C:\Users\Admin\AppData\Local\Temp\tmp8C42.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8C42.tmp.exe" C:\Users\Admin\AppData\Local\Temp\5f8edc075487dfd96e87c39edeb7565c9d61b5f2ce1449018b27f0e63f854f34N.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES8D4C.tmp

Filesize
1KB

MD5
c8bfe49928296e2f4ccf747a41a851e9

SHA1
13dd960fb24fab1b9f082f7aaeefd0884cf4c804

SHA256
9d46b164ba6bee4bc0efb68bfcb3a8058c923edc2b1796afe08c5b2f80552c3d

SHA512
270cfc61f1817c2da47a5f27cd304cd510acd2814bd65eb5c8d80eb549f64f4f796cdb05cbe5ef63f51aaf96cbae4096055ebf0c238a35a0c856ee5392bdd8e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\kbs2aguc.0.vb

Filesize
15KB

MD5
7edf28070c889cbd4eb1ad25f6d5191b

SHA1
41dc1b7e2036a6d1b8573a2348df60581a9fcf0d

SHA256
e41181931b54ebd665bbcd7601a9b784ae599dea8bd2b132f97b71b25679a9d9

SHA512
46a1c183e74629483cf2b3dfadad754aae541dc91d5f0d71361e28684ac5c38b84dd594941d0e90f405b720bbcafc1d035f0689cd1665191948effdfd99beadf

Download Submit
C:\Users\Admin\AppData\Local\Temp\kbs2aguc.cmdline

Filesize
266B

MD5
8a8fc1a8f0454cd77d648a9c9cd31506

SHA1
1f7e6792b9cd7ce57b8410a615264598c2c70317

SHA256
d7b38f50f66589eab17e256aaa129b950a4fa628ea1d19b6655cbcf6af506f70

SHA512
d12541c83c509673cd2be9fbaf01c3d48a6db2358a94234731a9898e01e3a70662817fffebda756ce981fb92ef2722cc54489b1c2629cf6731d6d8bdb0bd4921

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8C42.tmp.exe

Filesize
78KB

MD5
1a72f27bf668bde39cd0c693bc071609

SHA1
21d9ff7dea99b8508287e1c58892dfb2db0be030

SHA256
cac778656692836ac1770fbe21f04d56545a9a63edcbf5c35f18a585390f411b

SHA512
f4638e5f4a7e1362971fc8862f05e53f19d1c81ac90b34cb112ecb8bba1eafbe007a3639c3fa801e9270268e8b9a64e965dbff7a883fc81a0c841c4c648abe89

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1997DDB6EFDC4623ABEF635B44836627.TMP

Filesize
660B

MD5
fd9e48f7bf1484f8a0c1eb78925ab026

SHA1
ce86fa33cfd8b13e6387825bd1b8efb44c15436e

SHA256
22e32eb10287a2592311f9f7b1a4c424a31728516f330c5149a5f13cff31e5fe

SHA512
a81c14be5f0fc182d8a710bc7a8144167e9d85dfe65e4bc14f7e7827680859326a58e1b4081fefc3139fa8b12df5a362fc3565be3684f39d3364d8d1fd569465

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
8481b7e4924c14743ffc0d34075e2ce3

SHA1
e8e7ef480499ba85190b8d5f8e43f761850b0ef3

SHA256
6110931ed1cb1b1a141d4a12044a062646f14be3566a286106e5f59ceaddc4ac

SHA512
3c4ee8221c5238aed57e4fdbcd74833edcf46d5ed602840b5265438538405b4378a1966e9cd0c34a5ce52d0afe7bd7e0d9aac6b420e515fe1ea52477f957a7e1

Download Submit
memory/936-22-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/936-2-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/936-0-0x0000000074862000-0x0000000074863000-memory.dmp

Filesize
4KB

Download
memory/936-1-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/3144-23-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/3144-24-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/3144-26-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/3144-27-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/3144-28-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/3424-18-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download
memory/3424-9-0x0000000074860000-0x0000000074E11000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads