metamorpherrat | f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014

General

Target

f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe
Size

78KB
MD5

312b2cc8ea25af01ca9df477c4d04740
SHA1

035d33b077c0b6893428915cb39bc8d6e6c3fa96
SHA256

f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014
SHA512

6d8b1ac8f8ec0d2549a25ceb66e4a8d21047807901c73824b3c0302ed58a08e113e31646a202f70dedf79406c193bd7e783c80547e7481c4099ff9e144a95577
SSDEEP

1536:/WtHHM7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtRx9/b21bZ:/WtHshASyRxvhTzXPvCbW2URx9/2

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe

Deletes itself 1 IoCs

pid	Process
1772	tmp9134.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
1772	tmp9134.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmp9134.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9134.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe
Token: SeDebugPrivilege	1772	tmp9134.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4708	3516	f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe	84
PID 3516 wrote to memory of 4708	3516	f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe	84
PID 3516 wrote to memory of 4708	3516	f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe	84
PID 4708 wrote to memory of 3324	4708	vbc.exe	86
PID 4708 wrote to memory of 3324	4708	vbc.exe	86
PID 4708 wrote to memory of 3324	4708	vbc.exe	86
PID 3516 wrote to memory of 1772	3516	f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe	90
PID 3516 wrote to memory of 1772	3516	f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe	90
PID 3516 wrote to memory of 1772	3516	f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe	90

C:\Users\Admin\AppData\Local\Temp\f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe
"C:\Users\Admin\AppData\Local\Temp\f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7cbba71o.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92AB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1CCD9FDF7A495C80A2BEA5725C3C.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3324
- C:\Users\Admin\AppData\Local\Temp\tmp9134.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9134.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f535d466ac391e82fdbefdbbb4a6b1ce3b9e379cff0ae451dd6044c3a13f7014N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7cbba71o.0.vb

Filesize
15KB

MD5
71e0e15f3f23bd9f9ed96ceb37dde357

SHA1
97e607b8a762b94c2b59cf57cb27f893fcb2fd36

SHA256
5e0276cfeffe39fcfd54e602cc31609938401beba1ed7efcbaf582ae7c567d86

SHA512
4672784a11a55c4653d3c7b436a4fb55b8ab6e8b19f8bdad17d0fbbcba8f44f04662f6c10279478e3e2511e1a3455786a6c4b45efe4deeb449a69095e3d32d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7cbba71o.cmdline

Filesize
266B

MD5
50a1063185c86e1ac6932eb651612c7e

SHA1
4016aa0f4c4b2cebb4ca8588cb6bf32f929ab7dc

SHA256
855e85fa273e6906fd618ba7ef27cccc969d60889083122b17dac1ee3dd5cc61

SHA512
f7e9ad377d866c94fc56e1e439ae599acc5e8310e3f55027d5ba70234271f2b20869af516b584c49b4562c4a6bae2623ad1b2febbc9df4bfed19bf0fed87b0d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES92AB.tmp

Filesize
1KB

MD5
52c24cea9301d54a7aec58c381284824

SHA1
7fd42982f8f364e92621773bc2e68acfd90bc3fe

SHA256
73d7f210ccdf7351742a0ad87914f0f9da35da1cb3a4e31f00d3050c77f53811

SHA512
80e919731d33363f99a9cf8160e83065aca0c9131670bb53e04dacf3fadc8cc1b00e3007d6a715ce23498ccc5caf1662e7ba76e7360e1e091cd75119f9677ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9134.tmp.exe

Filesize
78KB

MD5
cbb578101936d744202aadbb63f941b8

SHA1
1cfc47f339a48ed2a17a93d0faa5a8f349c59c10

SHA256
cd363a98edd4d14aa4cff61b773bbdb306df0e1594baa581d2349699e94575c3

SHA512
e9440fb9257f58eab09cdced4b66c99e120cd7203d986392f0a9b50b3d6f4dfcd0a61ac785c9e4ddc5a6b4cb321751b672780d327ffe1ae4e9ff5eb89f75273d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc1CCD9FDF7A495C80A2BEA5725C3C.TMP

Filesize
660B

MD5
b9330026c33f643ca2a812b6a053480f

SHA1
a157b62bcf6c9c9d0de5e60110d609857324c4ed

SHA256
a1c854a9d2c16d546f49474f0e541104dfc4e9605336e3bb27bd661f724e59a1

SHA512
e082bb3e2b650343c4f3101c735734ad5bd8579888c1320db5d110253df353535f4a79852a0038f19d48fbef824a0098ccd65d78378025ce34b9dbc4f29cc529

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
8fd8e054ba10661e530e54511658ac20

SHA1
72911622012ddf68f95c1e1424894ecb4442e6fd

SHA256
822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7

SHA512
c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

Download Submit
memory/1772-23-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/1772-28-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/1772-27-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/1772-26-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/1772-24-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/3516-22-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/3516-0-0x0000000074AF2000-0x0000000074AF3000-memory.dmp

Filesize
4KB

Download
memory/3516-2-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/3516-1-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/4708-18-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download
memory/4708-9-0x0000000074AF0000-0x00000000750A1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads