Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2024 22:27

General

  • Target

    448e099e41b0730f0b736f603e4d8f2d802692da572ca58f09d98833fef1ab96.exe

  • Size

    78KB

  • MD5

    e81f39af6852661c5d7af31cb16eefe6

  • SHA1

    90150edd2d02c688e2de190e3187a3d2e45aae23

  • SHA256

    448e099e41b0730f0b736f603e4d8f2d802692da572ca58f09d98833fef1ab96

  • SHA512

    e37661771cecc969af48f10472911201a4d2c849a9e9bc1931d22a5b3dd765f10529485a08502fad931292c80d6a6ea771be4733bce9a20f690ba638f3bca4f7

  • SSDEEP

    1536:whHFo6uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtM9/M1I:cHFoI3ZAtWDDILJLovbicqOq3o+nM9/M

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\448e099e41b0730f0b736f603e4d8f2d802692da572ca58f09d98833fef1ab96.exe
    "C:\Users\Admin\AppData\Local\Temp\448e099e41b0730f0b736f603e4d8f2d802692da572ca58f09d98833fef1ab96.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pkbbdfqb.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2264
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8954.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6E6A380234DC437287FE937D54B4C9C4.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:632
    • C:\Users\Admin\AppData\Local\Temp\tmp8879.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp8879.tmp.exe" C:\Users\Admin\AppData\Local\Temp\448e099e41b0730f0b736f603e4d8f2d802692da572ca58f09d98833fef1ab96.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2340

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES8954.tmp

    Filesize

    1KB

    MD5

    7692f1a744166db0ffb731eb966bf3ad

    SHA1

    a562c0b4e1505d323e4e0ba10f72f69bf24d7041

    SHA256

    385b114df605691b21d785da3a9788d3fba750c64f43dd2ebf813a9afd13073c

    SHA512

    94b699f97cc9db55f7b6505a10f4a1da5ff2139c28b79be1c2f9d2f5c12ce7eb066ce0266740215d85cf4439f8a20aadf40218d75505878cb67baae8c9a6ff07

  • C:\Users\Admin\AppData\Local\Temp\pkbbdfqb.0.vb

    Filesize

    15KB

    MD5

    ff7b5a516c5a1cbe19457cf56508e36a

    SHA1

    351f671cbddea94f131f7f4113518e55b0517710

    SHA256

    e341615d34a8aaea11b75555584ae2746cd4ef9c4925337e6a8aa0f6d13d10de

    SHA512

    a63233d54890987f2c3d11196de3d107fda3e0c9ec522a600155bc907725bcb4c6e7fdcfe5dc0e727651c60760cac5d44f337a556c84a64dee666a1b4d31c12d

  • C:\Users\Admin\AppData\Local\Temp\pkbbdfqb.cmdline

    Filesize

    266B

    MD5

    b9c0f40f33854a76b678141155d9ca47

    SHA1

    e3f154c897ab3f8032b087ba0abbb76d10029603

    SHA256

    16e3b07bdb0ee27d255decb39381ceaaf6660aefd707bcef4edd20caa9d6f183

    SHA512

    585aee09ffc74b1471f3589343c6b4dd41a1e836cea964cb0bef70e3b98d784c3094c216cba067f180bb4df0cce867ffef438186b0eb07099926c670dca2921c

  • C:\Users\Admin\AppData\Local\Temp\tmp8879.tmp.exe

    Filesize

    78KB

    MD5

    a17ab494a23a4c5630511ab19b52a7b3

    SHA1

    487d88ac47f515c31f5f81505e8ef2475cd13c6c

    SHA256

    c454f4c1a3e7fae3378015b99782a89e5f394bef1aa28a0264e2d6e1f8362deb

    SHA512

    49aea4cea63a3f1425fed119bc7d3780b5866010c47a252ccdcd2dc32b96f91da2c2823741d5fd3c78d9d7539e4373a99244d5af01dca88eb819110fbcaca8d9

  • C:\Users\Admin\AppData\Local\Temp\vbc6E6A380234DC437287FE937D54B4C9C4.TMP

    Filesize

    660B

    MD5

    72b9ed99927edb2ab26350feb2f25523

    SHA1

    47c948c29339a959a1a409e0d5cbc7e31f1c1071

    SHA256

    4aa3e6bd48234e0938d55d10b5d14a40fbdffa1344d81c09f481a8da74cbc66d

    SHA512

    b150aa88cfce0160d702a63f42d07087f4b3d90bb744c4b133340dea03c41ee68e5dc4f68302b299184442dd7794691936f3ab3b7f705db569d7a54dfffe8e6f

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    a26b0f78faa3881bb6307a944b096e91

    SHA1

    42b01830723bf07d14f3086fa83c4f74f5649368

    SHA256

    b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5

    SHA512

    a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c

  • memory/2264-8-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB

  • memory/2264-18-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB

  • memory/2340-23-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB

  • memory/2340-24-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB

  • memory/2340-25-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB

  • memory/2340-26-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB

  • memory/2340-27-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB

  • memory/4432-0-0x00000000753B2000-0x00000000753B3000-memory.dmp

    Filesize

    4KB

  • memory/4432-2-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB

  • memory/4432-1-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB

  • memory/4432-22-0x00000000753B0000-0x0000000075961000-memory.dmp

    Filesize

    5.7MB