Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2024 23:12

General

  • Target

    6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe

  • Size

    78KB

  • MD5

    572af0c2681ed64595528c7bcb1f22b8

  • SHA1

    42a3442c0b9f911a3c7cf4848d0a32c0e4abc795

  • SHA256

    6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6

  • SHA512

    d14f3acf669745ca895c89f2fd8c3a6b4bf0a3c590ccf8b5d328e6f7cd3558dd58d5e3ae7a04f760b46f09d82792615e678fc7486d34afd1361152413c9e4357

  • SSDEEP

    1536:/Py5jSfXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96V9/H1AS:/Py5jS/SyRxvhTzXPvCbW2Ua9/R

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
    "C:\Users\Admin\AppData\Local\Temp\6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d3vyutvi.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC24.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEC23.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2608
    • C:\Users\Admin\AppData\Local\Temp\tmpEB1A.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpEB1A.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RESEC24.tmp

    Filesize

    1KB

    MD5

    ecb95144f34f44b9849a648cb92f4778

    SHA1

    b8e8743ce2092464545b0857d51790c6a5d32c6c

    SHA256

    774cf023aeb95c66f89965c8fb77ddaa2d75e061acd64ebf9101c9eb32302515

    SHA512

    606992617f4553a6e751e798987bdac0a01f007fb55365b36d9b18cb1e4e32a15f1b2a996a6945bbea16f14d2f36d0ebf7d7a88672e90995ad75bac1b9449873

  • C:\Users\Admin\AppData\Local\Temp\d3vyutvi.0.vb

    Filesize

    14KB

    MD5

    c7f837c3e95367fc8f8143aa892614af

    SHA1

    10efdad38f50f5d4d74003d152fccd0c86dcef3f

    SHA256

    7b894580ab7a7780821cb5ba2a2cbb1657417c7a025e6289fccd10d01634a67b

    SHA512

    30e53c7c4138f8195f6f9deadb2593d6525679cd8683d30c012cee45d431cc7665e6b68b61611512518e29937b4473505216ca140452132a8fce46343127b437

  • C:\Users\Admin\AppData\Local\Temp\d3vyutvi.cmdline

    Filesize

    266B

    MD5

    339e949af8e09bc3207701bd1c5fe4b1

    SHA1

    a235cbf9df5462d3d211d57429e36d8fe022f5cf

    SHA256

    01f1f99560beed6f9d178efa713557e227bed2c71d2e81c089bd627d8864a57d

    SHA512

    9c3dd801819bd0333f58ba73153a52f3916558e2cb0d3ee8d84c5a4b1657b2da23a927dba0ad31c13d13a8f938c152bb283b3e1fd0600ad2b022f1d30bf3523f

  • C:\Users\Admin\AppData\Local\Temp\tmpEB1A.tmp.exe

    Filesize

    78KB

    MD5

    18fdb6b605f5bbd01d4d359133c376a4

    SHA1

    89aae55bb201d1fee8a133febf0aae927c1e10f3

    SHA256

    bf36098d7f09dba5359b9ca8c5a6c8cecbc81b564aa6285080e6fbdaad96fa09

    SHA512

    37007dbac16426af4d762c5fafa5e459286d1044ab4d746ff0d11d5b2a276b1a8ea178dd526825e0648d0568fb31465311faea6fcf8ed6f65a6227d80e3a5359

  • C:\Users\Admin\AppData\Local\Temp\vbcEC23.tmp

    Filesize

    660B

    MD5

    33534d3bb2a9eac054afef0070080fe7

    SHA1

    030b90658356896886df8fdff7011a20a123911f

    SHA256

    0669b140d7347ed07d1cbac2594eebea145dacebfcaa12e2d681892c0403544e

    SHA512

    ae4dfa1613fa820c79dd8ed70d7b55ac4150da67fe7368a862827e962900712441deb8dcdae8a545b95a9cfae0a0dc16ad2f2810e7cbd538b29d53317b16e172

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    8fd8e054ba10661e530e54511658ac20

    SHA1

    72911622012ddf68f95c1e1424894ecb4442e6fd

    SHA256

    822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7

    SHA512

    c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

  • memory/2460-0-0x0000000074D01000-0x0000000074D02000-memory.dmp

    Filesize

    4KB

  • memory/2460-1-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2460-2-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2460-24-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2600-8-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2600-18-0x0000000074D00000-0x00000000752AB000-memory.dmp

    Filesize

    5.7MB