metamorpherrat | 6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6

General

Target

6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
Size

78KB
MD5

572af0c2681ed64595528c7bcb1f22b8
SHA1

42a3442c0b9f911a3c7cf4848d0a32c0e4abc795
SHA256

6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6
SHA512

d14f3acf669745ca895c89f2fd8c3a6b4bf0a3c590ccf8b5d328e6f7cd3558dd58d5e3ae7a04f760b46f09d82792615e678fc7486d34afd1361152413c9e4357
SSDEEP

1536:/Py5jSfXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQt96V9/H1AS:/Py5jS/SyRxvhTzXPvCbW2Ua9/R

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe

Deletes itself 1 IoCs

pid	Process
3288	tmpAB53.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
3288	tmpAB53.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspnet_state_perf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.Web.exe\""	tmpAB53.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAB53.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3092	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
Token: SeDebugPrivilege	3288	tmpAB53.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 2176	3092	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	83
PID 3092 wrote to memory of 2176	3092	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	83
PID 3092 wrote to memory of 2176	3092	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	83
PID 2176 wrote to memory of 5088	2176	vbc.exe	85
PID 2176 wrote to memory of 5088	2176	vbc.exe	85
PID 2176 wrote to memory of 5088	2176	vbc.exe	85
PID 3092 wrote to memory of 3288	3092	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	86
PID 3092 wrote to memory of 3288	3092	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	86
PID 3092 wrote to memory of 3288	3092	6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe	86

C:\Users\Admin\AppData\Local\Temp\6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
"C:\Users\Admin\AppData\Local\Temp\6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\275lunby.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABE0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB21D38F71E2F451CAA6FE597B75F2356.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5088
- C:\Users\Admin\AppData\Local\Temp\tmpAB53.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpAB53.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6c502ee0e70a630ab83a03ebcaf9c84ad1a833aa9424975d7c664f9014db7dc6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\275lunby.0.vb

Filesize
14KB

MD5
4ee5e373f03292bcfddbca6903fe14de

SHA1
554df223a0ef2472574819d05bd3e37e022f751a

SHA256
f72249445ada15e8779fd6fcde6ac913986491b7091df374f164211f22afb645

SHA512
7cf59c637234f911fb8b5b33cf897a99428b3fe01b5807930c268f1351f2b99c74d73166f3e7122f77f93d65480627b74727099c8620c633e4767fbfbfd98bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\275lunby.cmdline

Filesize
266B

MD5
9cd146b02e32d32cdee8ce1f6b0174ff

SHA1
7ac71e40a29a88819a79bebe316a6f1632230492

SHA256
30377382c304dbbfebfb57ba19c88377fe4c6660d413b2e6a2727202029bb142

SHA512
41b2dafb6cb15e4a7916451984014705fb51a6e0dc185267aeafdd2cb310f0dd094f4d848d480df0ebe019396b8320df54f1d638a7970cb4560913dfe66fd8b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESABE0.tmp

Filesize
1KB

MD5
9308001f32ce515670f8fb58dcdb3495

SHA1
b5170b4cc4f06f9dce06d6a8c401f050b203f880

SHA256
bfcf150fac9c96798d76b9c27ac45b6ee6768c55fa6abef763224d8338420957

SHA512
74608b9d5b96d933e307cca05e57c501877b8aaf9d80018b32fe1702c14da754fdfd5a8f6e13ada5caa83229672cb06603e97c756fbcb67e500e12cec8bdc7d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAB53.tmp.exe

Filesize
78KB

MD5
6f5b8a96f45cff168ef05b2a17b65b6d

SHA1
72f21dfeb6eb9516fdf7aa0ce06c4242027bf56b

SHA256
a5ee3f8caee0047547dffdeadc250a950dbf5c3eae48354646b5c5facf67d4bc

SHA512
f5a93587f2d2288eedacd323ff9060a360af418a444e7ed00df4984336a79a9ec7851e18447c4c3bd5b49229747b0d9a3cf364a8bb3be903ac9c65b902f876b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcB21D38F71E2F451CAA6FE597B75F2356.TMP

Filesize
660B

MD5
d87afe527b1c601b75091bb5d8aa1c99

SHA1
c6cdf13593b60233292dfcf2022c2cd45e4a5b02

SHA256
c739ea548abfba5088e91d608e3e6b7553105645e32dd686d1ce3af62209978f

SHA512
85673a99645c27aed793dd6576acde9252e46596d637fa1c72ff83feb89a704e20badb0a722339a5b0ec0db3ded062ad2a0a2d0923d744bc99d651e6473b712d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
8fd8e054ba10661e530e54511658ac20

SHA1
72911622012ddf68f95c1e1424894ecb4442e6fd

SHA256
822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7

SHA512
c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

Download Submit
memory/2176-18-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/2176-8-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/3092-0-0x0000000074842000-0x0000000074843000-memory.dmp

Filesize
4KB

Download
memory/3092-2-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/3092-1-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/3092-22-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/3288-23-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/3288-24-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/3288-26-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/3288-27-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/3288-28-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads