metamorpherrat | 6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6

General

Target

6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
Size

78KB
MD5

572af0c2681ed64595528c7bcb1f22b8
SHA1

42a3442c0b9f911a3c7cf4848d0a32c0e4abc795
SHA256

6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6
SHA512

d14f3acf669745ca895c89f2fd8c3a6b4bf0a3c590ccf8b5d328e6f7cd3558dd58d5e3ae7a04f760b46f09d82792615e678fc7486d34afd1361152413c9e4357
SSDEEP

1536:/Py5jSfXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96V9/H1AS:/Py5jS/SyRxvhTzXPvCbW2Ua9/R

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe

Executes dropped EXE 1 IoCs

pid	Process
1788	tmpAD57.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmpAD57.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAD57.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
Token: SeDebugPrivilege	1788	tmpAD57.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 1892	3668	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	83
PID 3668 wrote to memory of 1892	3668	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	83
PID 3668 wrote to memory of 1892	3668	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	83
PID 1892 wrote to memory of 4040	1892	vbc.exe	85
PID 1892 wrote to memory of 4040	1892	vbc.exe	85
PID 1892 wrote to memory of 4040	1892	vbc.exe	85
PID 3668 wrote to memory of 1788	3668	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	86
PID 3668 wrote to memory of 1788	3668	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	86
PID 3668 wrote to memory of 1788	3668	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	86

C:\Users\Admin\AppData\Local\Temp\6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
"C:\Users\Admin\AppData\Local\Temp\6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qnxs793b.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF0C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8132AE77BCDB41899BE8B0CAA47A9924.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4040
- C:\Users\Admin\AppData\Local\Temp\tmpAD57.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpAD57.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESAF0C.tmp

Filesize
1KB

MD5
37b324fa63b1b97f38124f2c80a6af31

SHA1
4f6e4456a328a1effbe499f2f865ae7fd7c97030

SHA256
05979b1ef92b8b45843580f0ce5666ecc521af12b158ca8cb36b13714b4c5283

SHA512
61893041d9d573a2ada4566f6a97715c81944cc2a242c5cfba34e06ed2f0da5e00c4bb7bc777f6ab7be1898928a939be4efd80a74c02dbe49e1fa4bc8e9e6c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\qnxs793b.0.vb

Filesize
14KB

MD5
208f4b7633b35e2311074061777e4db6

SHA1
9299d67ace27ead3ca47d09ddeb0d50f467c3708

SHA256
b152212da66f56b87676219bc1483fcddbdcfb62fd1fcc5b48752eead8ff6e1a

SHA512
c7720d298dbe692fa78bbb6b2756108ebae300b251d39323f6adf75323b88c986a211b7c099f4c5c0cc914d0107660de855af3971196455770d4a3dc0852dbd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\qnxs793b.cmdline

Filesize
266B

MD5
3b8017670a6753a6401066fed8952222

SHA1
bce6a8e85cb0bc71cf25afe1e76742fc382f3185

SHA256
f471633d26b5f9d729252939052a1883e6d55a628591633d747da957b8c8ea01

SHA512
8aee9511cd7dedbae1fc1595ffaeb2455d1937de63bf77dec67ae79ba8fdbb8b7906ea5764963da65b71c1e4d0664f527155b91f829c97a4e89c47f93368911e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAD57.tmp.exe

Filesize
78KB

MD5
7d8545c3d59526e16dfcfdb131e87eb0

SHA1
5c5daeac792b591808755adc2446f0914e861314

SHA256
a80fdb5bf6e412cee7e194dfdb480d06289b630e2f7860136f0bf07a0143f227

SHA512
6c96d26b41473db212ad9aa8a9056afd63d091964a8b6927803cf107705276d4b3a105061c17d76b7147a9e2c19ac77891777d052f2029537439d2fc237493cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc8132AE77BCDB41899BE8B0CAA47A9924.TMP

Filesize
660B

MD5
76e7848c5cb28c9e0514d5e4cca7895c

SHA1
8cc61e8ea5da1538895f98caaca364b4ad4f82b5

SHA256
2f669020c8187e11f2529f484e61d6e78a666d8df7c6295fb72438392c456986

SHA512
26f0dc16e30b9aad75802b2dceb8e9821c31eca57055468391448fae449a3994a3bf10969af3f2139436ac9ad2c29dd6cde869d9df852f92988bd7922c96240b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
8fd8e054ba10661e530e54511658ac20

SHA1
72911622012ddf68f95c1e1424894ecb4442e6fd

SHA256
822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7

SHA512
c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

Download Submit
memory/1788-23-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/1788-28-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/1788-27-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/1788-26-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/1788-24-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/1892-18-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/1892-9-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/3668-22-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/3668-2-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/3668-1-0x0000000074A20000-0x0000000074FD1000-memory.dmp

Filesize
5.7MB

Download
memory/3668-0-0x0000000074A22000-0x0000000074A23000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads