Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4284e008ce...75.exe

windows7-x64

10

4284e008ce...75.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2024, 18:13 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4284e008cefe03ca70bb547b4c52592b3970996308a6462500c8fbaffe378275.exe

  • Size

    78KB

  • MD5

    7fcb227cf50a8a6d141a28f5baf6857b

  • SHA1

    bbaeca896472b6a7d1e67a545e9b537ff522fd97

  • SHA256

    4284e008cefe03ca70bb547b4c52592b3970996308a6462500c8fbaffe378275

  • SHA512

    70301203754303b20ae3765be57c98cae6c15389e566ed6187df71bb3ce600ea74cb6d015dfbba57caa6e21c2b7a6e2704e42a120fab06ab6cbcdbae90a51328

  • SSDEEP

    1536:iV58MLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQti6N9/u1L08:iV586E2EwR4uY41HyvYl9/f8

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

    trojanratstealermetamorpherrat
  • Metamorpherrat family
    metamorpherrat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4284e008cefe03ca70bb547b4c52592b3970996308a6462500c8fbaffe378275.exe
    "C:\Users\Admin\AppData\Local\Temp\4284e008cefe03ca70bb547b4c52592b3970996308a6462500c8fbaffe378275.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3316
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g2biqdhw.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3360
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7A7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc506ADEEF1841434CA22AFBFCAC8D391.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3588
    • C:\Users\Admin\AppData\Local\Temp\tmpB67F.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpB67F.tmp.exe" C:\Users\Admin\AppData\Local\Temp\4284e008cefe03ca70bb547b4c52592b3970996308a6462500c8fbaffe378275.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:864

Network

  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    99.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    99.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    bejnz.com
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    bejnz.com
    IN A
    Response
    bejnz.com
    IN A
    44.221.84.105
  • flag-us
    DNS
    rwkeith.no-ip.org
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    rwkeith.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    107.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    107.12.20.2.in-addr.arpa
    IN PTR
    Response
    107.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-107deploystaticakamaitechnologiescom
  • flag-us
    DNS
    rwkeith.no-ip.org
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    rwkeith.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    rwkeith.no-ip.org
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    rwkeith.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    rwkeith.no-ip.org
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    rwkeith.no-ip.org
    IN A
  • flag-us
    DNS
    rwkeith.no-ip.org
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    rwkeith.no-ip.org
    IN A
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    rwkeith.no-ip.org
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    rwkeith.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    rwkeith.no-ip.org
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    rwkeith.no-ip.org
    IN A
  • flag-us
    DNS
    rwkeith.no-ip.org
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    rwkeith.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    rwkeith.no-ip.org
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    rwkeith.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    bejnz.com
    tmpB67F.tmp.exe
    Remote address:
    8.8.8.8:53
    Request
    bejnz.com
    IN A
    Response
    bejnz.com
    IN A
    44.221.84.105
  • 44.221.84.105:80
    bejnz.com
    tmpB67F.tmp.exe
    260 B
     5
  • 44.221.84.105:80
    bejnz.com
    tmpB67F.tmp.exe
    260 B
     5
  • 44.221.84.105:80
    bejnz.com
    tmpB67F.tmp.exe
    260 B
     5
  • 44.221.84.105:80
    bejnz.com
    tmpB67F.tmp.exe
    260 B
     5
  • 44.221.84.105:80
    bejnz.com
    tmpB67F.tmp.exe
    260 B
     5
  • 44.221.84.105:80
    bejnz.com
    tmpB67F.tmp.exe
    260 B
     5
  • 44.221.84.105:80
    bejnz.com
    tmpB67F.tmp.exe
    156 B
     3
  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    99.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    99.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    0.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    0.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    bejnz.com
    dns
    tmpB67F.tmp.exe
    55 B
     71 B
     1
    1

    DNS Request

    bejnz.com

    DNS Response

    44.221.84.105

  • 8.8.8.8:53
    rwkeith.no-ip.org
    dns
    tmpB67F.tmp.exe
    63 B
     123 B
     1
    1

    DNS Request

    rwkeith.no-ip.org

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    210 B
     156 B
     3
    1

    DNS Request

    50.23.12.20.in-addr.arpa

    DNS Request

    50.23.12.20.in-addr.arpa

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    142 B
     145 B
     2
    1

    DNS Request

    241.42.69.40.in-addr.arpa

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    107.12.20.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    107.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    rwkeith.no-ip.org
    dns
    tmpB67F.tmp.exe
    63 B
     123 B
     1
    1

    DNS Request

    rwkeith.no-ip.org

  • 8.8.8.8:53
    rwkeith.no-ip.org
    dns
    tmpB67F.tmp.exe
    189 B
     123 B
     3
    1

    DNS Request

    rwkeith.no-ip.org

    DNS Request

    rwkeith.no-ip.org

    DNS Request

    rwkeith.no-ip.org

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    rwkeith.no-ip.org
    dns
    tmpB67F.tmp.exe
    126 B
     123 B
     2
    1

    DNS Request

    rwkeith.no-ip.org

    DNS Request

    rwkeith.no-ip.org

  • 8.8.8.8:53
    rwkeith.no-ip.org
    dns
    tmpB67F.tmp.exe
    63 B
     123 B
     1
    1

    DNS Request

    rwkeith.no-ip.org

  • 8.8.8.8:53
    rwkeith.no-ip.org
    dns
    tmpB67F.tmp.exe
    63 B
     123 B
     1
    1

    DNS Request

    rwkeith.no-ip.org

  • 8.8.8.8:53
    bejnz.com
    dns
    tmpB67F.tmp.exe
    55 B
     71 B
     1
    1

    DNS Request

    bejnz.com

    DNS Response

    44.221.84.105

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RESB7A7.tmp
    Filesize

    1KB

    MD5

    e377acca1cba5ce99ffd540c69e43192

    SHA1

    562db61cc5e51d5c0ff40c19a1fb595c427a8219

    SHA256

    56d7bf1fff4fb29396fe16a5dbd81b91dd0b69db8e1e9918f6aa0d7470b664c1

    SHA512

    83017d0e4765e788623645b2be6065362cd42b0935f685ed0674cf65afb05634f20764d8fcdecb99fb03730838ad1f621a4b530bd4f8b35eb0d0135033232945

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\g2biqdhw.0.vb
    Filesize

    14KB

    MD5

    e251d47729728262ee210117448af94e

    SHA1

    09076ef7484bfa52d89dd60f77a7aeaf94caa2f8

    SHA256

    11b86006593b78ed10dc3036b7853df033ba6ca5396a67da2f8eff26fe9b0b34

    SHA512

    71a77c54dc1f0cd5db3f673204457b42bf94938666c29c65d39a65a9494985cf7fd7e20152abc15b9693429cde2aadf04fa700156a064766356d8fd65f255016

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\g2biqdhw.cmdline
    Filesize

    266B

    MD5

    5c9ad735ad64dfa7efaf8f2c636f0b34

    SHA1

    46084520e49e7a77202d02c47730bc9607600c3c

    SHA256

    2609f454bae10036bd4ebcf294288413791a1c486d5258090b468270a8a6ef5f

    SHA512

    1b49b9fd4c140cbfb1fb05aed97b92dae1ba7a04caddee2457b16360912ea050600ad1a66aeea02b1e6a5647f6c817539c398ae4735e67d4777d66450c36fe90

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpB67F.tmp.exe
    Filesize

    78KB

    MD5

    3476abd8519d8ef34ece99d17c904593

    SHA1

    d31118a8e40a71c1fe789fadae23f0579311932a

    SHA256

    5702a1919af5e3043c0035ee77c80094c5a3e7ebefe23b48cf250aabd0a61d3b

    SHA512

    3429e97d7cf7f489aa32cbaf653975e0545bf828983c1f0a78b67ce14b22f8631f15425a9db00c9253d09ea73302416b28894a09f77ee5eca88f57001c38927a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\vbc506ADEEF1841434CA22AFBFCAC8D391.TMP
    Filesize

    660B

    MD5

    c3a06e8c680c0f97787c79cf23b52c2c

    SHA1

    27fadefd8709306dea72ffa12634a23be5a015e3

    SHA256

    15fc9d183d0ccf7f4719f12de3aa4efe57760fa48294a55f9ae5b39a71f8ddf1

    SHA512

    80e787ee8edc057e659588bedff4094c6dcf71c11d30a4831dd2ed7c4d6985c407f3d38be1ed1f56f1b5a4cd63a2e41d208ad9d9926548bfd592d090fe1f510d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources
    Filesize

    62KB

    MD5

    6870a276e0bed6dd5394d178156ebad0

    SHA1

    9b6005e5771bb4afb93a8862b54fe77dc4d203ee

    SHA256

    69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

    SHA512

    3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

    Download Submit

  • memory/864-24-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/864-29-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/864-28-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/864-27-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/864-25-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3316-0-0x00000000749B2000-0x00000000749B3000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3316-23-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3316-1-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3316-2-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3316-3-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3360-19-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3360-9-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.