metamorpherrat | 199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61

General

Target

199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe
Size

78KB
MD5

41d48e54bdde61dbaef4a2459f0b365a
SHA1

5cbf19224961eae086069f8176102eca8742358b
SHA256

199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61
SHA512

c742f0f2bfcf44576ebe57d6f7a7128367e27991eeaf4a8cacad59e04276fdf993eab659ad4754fa150351b2abfd37ec3c5bff6c51d83cbc68e1ecb2910a541b
SSDEEP

1536:5mCHHuaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtL89/n161:UCH/3ZAtWDDILJLovbicqOq3o+nL89/K

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
1984	tmpB809.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe
3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmpB809.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB809.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe
Token: SeDebugPrivilege	1984	tmpB809.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2420	3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe	30
PID 3048 wrote to memory of 2420	3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe	30
PID 3048 wrote to memory of 2420	3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe	30
PID 3048 wrote to memory of 2420	3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe	30
PID 2420 wrote to memory of 264	2420	vbc.exe	32
PID 2420 wrote to memory of 264	2420	vbc.exe	32
PID 2420 wrote to memory of 264	2420	vbc.exe	32
PID 2420 wrote to memory of 264	2420	vbc.exe	32
PID 3048 wrote to memory of 1984	3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe	33
PID 3048 wrote to memory of 1984	3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe	33
PID 3048 wrote to memory of 1984	3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe	33
PID 3048 wrote to memory of 1984	3048	199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe	33

C:\Users\Admin\AppData\Local\Temp\199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe
"C:\Users\Admin\AppData\Local\Temp\199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gpqrbprj.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8A6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB8A5.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:264
- C:\Users\Admin\AppData\Local\Temp\tmpB809.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB809.tmp.exe" C:\Users\Admin\AppData\Local\Temp\199ddce4e0b3a393414a01566c7aa42efe4e8e894a16780716517a39b7157f61.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESB8A6.tmp

Filesize
1KB

MD5
611bc924475209a0623d4bb4218dc43c

SHA1
2979cdb601470e8e72d2b0c65667b38ce6424a5a

SHA256
2c4d4f958f50b76c03773280d32a86b76a29f20716ea3753dccddb4c15f4ae98

SHA512
3171adcfeabe03fe926779a122a1faf597b07bc2cbcca021a6f4cca1cc049ceb75243f77110ec9a268512eeb26c3880196fa62fa19f6f4866908e799aa996fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\gpqrbprj.0.vb

Filesize
15KB

MD5
c9336d7f4412fcfe542ba7b7e0dfb0c3

SHA1
1ab48961da8ddc453da7df76cedc4e1df5c509ae

SHA256
1c2a3cc6767a77b0c8d94c2fa2b4355ece8af0329ed22608291bc260c3ede9ca

SHA512
e859ecaf15895c6dac4894399dccee40b40e14f74ff00472f62aa06d173392e294fbd38278db69489e063503de272595a93ecffbacd635ff8750b18e3d555c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gpqrbprj.cmdline

Filesize
266B

MD5
76a86fb20c3d96264e3a2ea9dc3c3ef0

SHA1
4980d87d88c6306609846c71506fd5e8f4cec517

SHA256
0a83421f2d1c32aec5b35e7c03eca56236add1128f6840c85c75c259592bc1e7

SHA512
98bacc0ce2ef1cf1b4b6b7a78a24edc0b09caaecd4d23ddb0d7b6c28799d324aeabb336295213844d03154b711f978c7e6ba1977b567969eab59acab5dcf1818

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB809.tmp.exe

Filesize
78KB

MD5
384b001045e5d9bf187c92537adf7052

SHA1
835e886e2e45d731f04964c5756820e492844914

SHA256
db2ce480466e12d5b8a274b102df53d27f13897e25ceadc475d42f9d4b32912a

SHA512
56d23e83208869850253f7b90beee1488453e78a3f57fd178c869e62721e031d0396bc9e74381673981308f06326cef3044f1cc27fe9236fae1df57e2d4a86a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcB8A5.tmp

Filesize
660B

MD5
b42944a87a9c1c5cb24f8f9509c7a2c8

SHA1
a7841667a1d16c1e682b1349e4fd5b7002afc742

SHA256
363e65a2f00e09eaa110ccc8d5be194d153ef1b3a68e71f81149a40332ea1a4c

SHA512
aae2ae64a1396e0a8215dbddf82ff697ff8d74b115b2ab36a428d1442f0fa893a687c24389b8ed2920bfd963c459ecd1ebff41f9b1b38b657e9ab339e3a2570d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
a26b0f78faa3881bb6307a944b096e91

SHA1
42b01830723bf07d14f3086fa83c4f74f5649368

SHA256
b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5

SHA512
a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c

Download Submit
memory/2420-8-0x0000000074680000-0x0000000074C2B000-memory.dmp

Filesize
5.7MB

Download
memory/2420-18-0x0000000074680000-0x0000000074C2B000-memory.dmp

Filesize
5.7MB

Download
memory/3048-0-0x0000000074681000-0x0000000074682000-memory.dmp

Filesize
4KB

Download
memory/3048-1-0x0000000074680000-0x0000000074C2B000-memory.dmp

Filesize
5.7MB

Download
memory/3048-2-0x0000000074680000-0x0000000074C2B000-memory.dmp

Filesize
5.7MB

Download
memory/3048-24-0x0000000074680000-0x0000000074C2B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads