metamorpherrat | 4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1

General

Target

4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe
Size

78KB
MD5

425ca0a0d0e9bcca9812b5f48a56c955
SHA1

721290757978f2fddd1b3cc6f5f200344a20b38e
SHA256

4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1
SHA512

c9f86663fb8f3a700ef3357b505c97eec17a0ae45235cf693f5a6378c44e4d2e47e896753e9000cae59587db36961d7addb5cda8ee6bc61b43d697683a09f0a3
SSDEEP

1536:SvWV58/pJywt04wbje3IgTazcoOEEQLwdCRoaeuProYMHQti6d9/2K1Zgq:sWV58BJywQjDgTLopLwdCFJzF9/2Jq

Score

10^/10

metamorpherrat discovery rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe

Executes dropped EXE 1 IoCs

pid	Process
2136	tmpF721.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpF721.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe
Token: SeDebugPrivilege	2136	tmpF721.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 4932	3344	4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe	83
PID 3344 wrote to memory of 4932	3344	4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe	83
PID 3344 wrote to memory of 4932	3344	4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe	83
PID 4932 wrote to memory of 4864	4932	vbc.exe	85
PID 4932 wrote to memory of 4864	4932	vbc.exe	85
PID 4932 wrote to memory of 4864	4932	vbc.exe	85
PID 3344 wrote to memory of 2136	3344	4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe	86
PID 3344 wrote to memory of 2136	3344	4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe	86
PID 3344 wrote to memory of 2136	3344	4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe	86

C:\Users\Admin\AppData\Local\Temp\4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe
"C:\Users\Admin\AppData\Local\Temp\4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l8lkjrlx.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF82B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEF569AF3B88440BCAAEF6ED148928F5.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
- C:\Users\Admin\AppData\Local\Temp\tmpF721.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpF721.tmp.exe" C:\Users\Admin\AppData\Local\Temp\4f112b3cfe0291544cd34b83c02e76ce6bb47ab7fb7ae073ac8e0933000854b1.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESF82B.tmp

Filesize
1KB

MD5
b2f478062916042c73227162ab549e4c

SHA1
fa26d41681e56441a7e0c0bf5e474f5857316816

SHA256
eaeb9eb8944f5d17a0a10ebc361782cbea2331dafbaebc445863c33f87a49e72

SHA512
7e6103b7d82c7a12bcec978deba62b3b9312230d84ef9cee6a18f514f1cac41d1442425fa9761eee44fae43714f6dd239929aad15d2f7c4ef0db7b433e1ae93c

Download Submit
C:\Users\Admin\AppData\Local\Temp\l8lkjrlx.0.vb

Filesize
14KB

MD5
d292c8fb0ca180ef2211455fa3d2936d

SHA1
0eec5ba526ba20cc4cb413bcf5780e219ceeeca8

SHA256
56e0f14a51844ea17f63958ec3c1ee50ea5f3432d4406a320cca7fed52dccd07

SHA512
edd816e84da21c9159b395256d81129612e8704e63ae550b1e177b17d5b560772617a916bb13ca7ed2a9b771048275fe806c405b4454e6c88360c1d57e718b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\l8lkjrlx.cmdline

Filesize
266B

MD5
f11b9070ce5b54e3e6ce4b39e20b7522

SHA1
dbae81eea714d116813629b1f08c4228183435b9

SHA256
d54a4f9bf34eb67360fddc2bd38075ba7174ab4b768f3142aa551d5376c00727

SHA512
1e885deef8b5260336d966302f768d75e35e07d6bb8f195d3671879beaa6bae1e2a34204ad4f4f2dd04c252daaf6c29052482e93fe5d2d8ad49209a11b4a1f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF721.tmp.exe

Filesize
78KB

MD5
afdfb4eb2b79106291438f1b9cdc7a2d

SHA1
2d6b783e58fbccc130a8c6c0f4df13bfa5327cbf

SHA256
909be2202f158a529786e972260cefb6999be130ded06ed0707c91ff0ae09655

SHA512
2a018a746b3c143e1ac92a9d3d1189fb1fa92fef145f5a56ddb7a871120bf1e4f3b73e4fc09bc3948d43f13fe53915812146e87b22713c3c80424b8df0439a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcEF569AF3B88440BCAAEF6ED148928F5.TMP

Filesize
660B

MD5
1dd61b72adaddbd0ba1eaf0d057a60e5

SHA1
4a83ae5ac2469b3c5f8af526e4c7d49ca93abe1c

SHA256
7d032d232fbee81e1845794700b01e48c7cfdafb82e834cbde9ef77d4b61c547

SHA512
0474c27df3f3459737a169e7b14d19f6bb7462b88bc16377fc986bee0208eac35a614473fdfde8d0566c8b43b528dda6a801813cf0fe6f0de898f675c81d9ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
484967ab9def8ff17dd55476ca137721

SHA1
a84012f673fe1ac9041e7827cc3de4b20a1194e2

SHA256
9c0a54047f133cf4e3e4444aa57cc576c566218217ea02ad7c04a408ad01791b

SHA512
1e9a0cc800543dada73e551ee714001c4d6c57a595ea2986a4dd8889d1dffd1557735580c694e5feb0b7c27c1a4b3e71a95fab8baf80839f42f80e2109cbe2d7

Download Submit
memory/2136-28-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/2136-24-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/2136-27-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/2136-29-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/2136-26-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/2136-23-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/2136-25-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/3344-22-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/3344-0-0x0000000074852000-0x0000000074853000-memory.dmp

Filesize
4KB

Download
memory/3344-2-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/3344-1-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/4932-18-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/4932-8-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing