Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2024 18:33

General

  • Target

    fca0eba34eab4134aa1856cfe5df3b5099af5a580d45f695abc886e31d125b81.exe

  • Size

    78KB

  • MD5

    fa1f726c2bd7e3e3053ec9c9f2b2fcda

  • SHA1

    4f7eaa0f880d1cbe4c48a8dd8ff11f1f3ec97dd0

  • SHA256

    fca0eba34eab4134aa1856cfe5df3b5099af5a580d45f695abc886e31d125b81

  • SHA512

    140f7b066c9654e55ae7c842a3a6bba3e016848f19e0dc22162371c47afbd103edc7365201115dd40047167192c68a4c35ec52066f9c8d0718cd76c544e32d47

  • SSDEEP

    1536:oV5jS6XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtC6zP9/p1qhC:oV5jSiSyRxvY3md+dWWZybP9/eC

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fca0eba34eab4134aa1856cfe5df3b5099af5a580d45f695abc886e31d125b81.exe
    "C:\Users\Admin\AppData\Local\Temp\fca0eba34eab4134aa1856cfe5df3b5099af5a580d45f695abc886e31d125b81.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3y8zgxrt.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75CC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE920F51CAC4D4AB9A46A6B141B80957D.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4544
    • C:\Users\Admin\AppData\Local\Temp\tmp736B.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp736B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\fca0eba34eab4134aa1856cfe5df3b5099af5a580d45f695abc886e31d125b81.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3y8zgxrt.0.vb

    Filesize

    14KB

    MD5

    7d980007f2badc03a0309df203866718

    SHA1

    abb5b14cd48d5676d0319106527de15b21bb416b

    SHA256

    857873981c05464730681d52d20af37edb55e29083264ed2a7663b4b6d758c3d

    SHA512

    8dec58f2e4a0311854829da0d7749af09460bf003dffbce1a27c80b17be6d88d9c8008d943b0c6bdc2ee5fa1e6bae3640162fcfa9300e31091987b87dada48bf

  • C:\Users\Admin\AppData\Local\Temp\3y8zgxrt.cmdline

    Filesize

    266B

    MD5

    5920ca6251a16ed7d1503a5b9fd33956

    SHA1

    34ea89673bcaea937099c4b665119cc042ac4f3d

    SHA256

    efbfede496068c11d381cc1cffca7b995e712d6c2a728536a9cdd6831a7787d1

    SHA512

    46e02bbafedffa7208bc766c667a062597d0a81930d3d8333d7889c8a473301d7a53bbc440aefa7c0384534ab6adb8e20df9ffeb605456837c2e0be35e4a96a2

  • C:\Users\Admin\AppData\Local\Temp\RES75CC.tmp

    Filesize

    1KB

    MD5

    9f7d2fde3de8855384d71d995e18be0a

    SHA1

    5c6c434881c5f71c065822234235e5bc963d80a6

    SHA256

    686c944f8b15f74e195fee4114577c7fe29dd16d3e65bc7212bcbb9f4e31eb6b

    SHA512

    e910516978912d7966f17117c0b6e947b16c8ef6bd3d2e82beaf10269f7d613bb8e701dcd1db6c43864e7c23a5ce92d9ff663eb055ff21b0a1e173c14f89bd3d

  • C:\Users\Admin\AppData\Local\Temp\tmp736B.tmp.exe

    Filesize

    78KB

    MD5

    d2dad5a7554ed814b34fd26bcd9637ec

    SHA1

    2fb547ae5d341b46fbe1e2d71d090db0f1e28110

    SHA256

    38cafb36872acb0828f664c332c6e753fa5468f21ec1b78a1f81e99b44fff365

    SHA512

    20f9d073956f0b4d8855d4a42e197aac0fed274696a5aa2ca5f7dbea743fe3940695f6fcc8f0028067fdfa048010ba5b0d394aef0ce542ef31309266f069b350

  • C:\Users\Admin\AppData\Local\Temp\vbcE920F51CAC4D4AB9A46A6B141B80957D.TMP

    Filesize

    660B

    MD5

    82ee0b0364f2a6ead9e7631461db68ce

    SHA1

    7e58ce553bb8fbe9c0e50ee0a022942589e37063

    SHA256

    c9991898a97fb4a406f8092ac954fcb7c40f0a802760c53f9ee68bab52d31a26

    SHA512

    ba4c8b10b1ec28faf9aab178c1c77e1255f275bda456815018b988d54214e810ee3be3c8ec639f30d1e2e659ff90a08bf9c3acefda931a69bc862b3f287a1cde

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    4f0e8cf79edb6cd381474b21cabfdf4a

    SHA1

    7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4

    SHA256

    e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5

    SHA512

    2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107

  • memory/432-23-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/432-24-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/432-25-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/432-27-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/432-28-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/432-29-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1020-0-0x0000000074CF2000-0x0000000074CF3000-memory.dmp

    Filesize

    4KB

  • memory/1020-1-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1020-22-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1020-2-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1724-9-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1724-18-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB