metamorpherrat | 2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509

General

Target

2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe
Size

78KB
MD5

2bf1fc5fc39a05ac6f85f38847b3ca60
SHA1

a8325a6233e86978851be69b29b94c47bba3922f
SHA256

2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509
SHA512

dcfd2ac642d05e2684d9acece61b665296f19c50490c41cbbe47b302e0c0e6b5265343afd9c9ac78c44dc5479aecc06d4c83f14bcd9509d68abca9d69016c421
SSDEEP

1536:yVc5fAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtS649/j11NEK:oc5fAtWDDILJLovbicqOq3o+nw9/jqK

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
1984	tmpA17D.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe
2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmpA17D.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA17D.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe
Token: SeDebugPrivilege	1984	tmpA17D.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2836	2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe	28
PID 2912 wrote to memory of 2836	2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe	28
PID 2912 wrote to memory of 2836	2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe	28
PID 2912 wrote to memory of 2836	2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe	28
PID 2836 wrote to memory of 2196	2836	vbc.exe	30
PID 2836 wrote to memory of 2196	2836	vbc.exe	30
PID 2836 wrote to memory of 2196	2836	vbc.exe	30
PID 2836 wrote to memory of 2196	2836	vbc.exe	30
PID 2912 wrote to memory of 1984	2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe	31
PID 2912 wrote to memory of 1984	2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe	31
PID 2912 wrote to memory of 1984	2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe	31
PID 2912 wrote to memory of 1984	2912	2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe	31

C:\Users\Admin\AppData\Local\Temp\2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe
"C:\Users\Admin\AppData\Local\Temp\2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zcj9sdvd.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA2D4.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2196
- C:\Users\Admin\AppData\Local\Temp\tmpA17D.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA17D.tmp.exe" C:\Users\Admin\AppData\Local\Temp\2a60f5beb7e76d1142c00699aa864dfac91f1024c5d81145c506a57d261be509.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESA2D5.tmp

Filesize
1KB

MD5
c882544cce668a5d5244d29f378ca5dc

SHA1
4d03eacefbee7bb182972308f8312f00264e214c

SHA256
b9d8f43596ad9f7a9c8793af05a61abeaf88dc704cb0230763d8258b005d48c0

SHA512
f3318bdf6de6443fcc8b9ffad4202f3a55cf9fc3269df58cea631d8a717e4a7964e9fb9d85a0b681a980850a7cacde741c6aa51d76c106aec63181c95b640517

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA17D.tmp.exe

Filesize
78KB

MD5
40a781f8a30c0e97cdb223f7985e69f1

SHA1
fb8ef5cf1ccb8ad607ba2d59941981ee28832677

SHA256
f24709fab8aacedc5b76048688fafd34ecf9553ad42235dc4cb354a92046c207

SHA512
0947e6fb0e662f49c264a8f82c5efa0acd32d3c04a605aeda8ffaed9440caa1ae4ddf00395d93d0a5880f321d7eae40c7334f87378f9f5bd42edf1f191346e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcA2D4.tmp

Filesize
660B

MD5
cf75dd60bcd0ca6df8ee76b04c925b95

SHA1
bcf6a9de07d5b2d96e537c02cfa288f1c9e08410

SHA256
413034c8f59dcdc4e728520406ee864e9522b747803f8b7e21a42a60f8bba8fc

SHA512
fc99fbfbf96b8c3de26199ffd14684abc80e00ab2462496c581580e150b2e7dfecb4174ea7363ee44d4c0e7e80b44c16636087ce6a662972e914ddff89e1c1ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
a26b0f78faa3881bb6307a944b096e91

SHA1
42b01830723bf07d14f3086fa83c4f74f5649368

SHA256
b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5

SHA512
a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zcj9sdvd.0.vb

Filesize
14KB

MD5
7127911c1dba05f5742f260b100e91af

SHA1
7d9529d36b67c6a6b047a1007e746bd2960bc47a

SHA256
364b0d07289a08a70d84eff469cdfcb65ddda477ae478977e0252788b56500d1

SHA512
cb9b48573a69df0152b524e41adfc44861f5c2ee4d02e35c5323727841ec15f29936f16a3a882ce1c20cab09a7cdc56e07bb237a1d03597953db9a22765769e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zcj9sdvd.cmdline

Filesize
266B

MD5
c20d6ea4548856205fc6ac205c409e38

SHA1
c00f6e0ac11d4db594c149388c2c59f209aa6b73

SHA256
ef0e8b2ce596feb1f16e7ffe4cd563968d28dccbd92434e95197e9b2c51ff565

SHA512
ad35ff8861e8bc51fe49d2a3e337ffe4da077930bb50aa8999b6f595ebfaaddadf83fc0cb270d3f9f8454d0c74a5d98699027c76032398766979dcf2751cfb02

Download Submit
memory/2836-8-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2836-18-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2912-0-0x0000000074531000-0x0000000074532000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2912-2-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2912-24-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads