metamorpherrat | dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbc

General

Target

dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe
Size

78KB
MD5

3584d349a83e79620e77fbb65ac995e0
SHA1

066e6a2d4e7cf22c557fa0a7544cd958e7da69a2
SHA256

dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbc
SHA512

cb483d653e7d809e5123d4f4cdcdc66534d788ee390877bc6a7b3b7388d9b74be6e15b25997c93c3d602a8181bb39fd668e73ba0cf5103bce8bcaa7fa9c5479d
SSDEEP

1536:We5hXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtN6g9/F1hn:We5hSyRxvY3md+dWWZyP9/J

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	tmp9366.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShFusRes = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\big5.exe\""	tmp9366.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp9366.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3612	dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe
Token: SeDebugPrivilege	2004	tmp9366.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3416	3612	dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe	83
PID 3612 wrote to memory of 3416	3612	dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe	83
PID 3612 wrote to memory of 3416	3612	dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe	83
PID 3416 wrote to memory of 3256	3416	vbc.exe	85
PID 3416 wrote to memory of 3256	3416	vbc.exe	85
PID 3416 wrote to memory of 3256	3416	vbc.exe	85
PID 3612 wrote to memory of 2004	3612	dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe	86
PID 3612 wrote to memory of 2004	3612	dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe	86
PID 3612 wrote to memory of 2004	3612	dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe	86

C:\Users\Admin\AppData\Local\Temp\dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe
"C:\Users\Admin\AppData\Local\Temp\dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mvjbtcmv.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9625.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCC936193E41143118ED26A458965F71D.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3256
- C:\Users\Admin\AppData\Local\Temp\tmp9366.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp9366.tmp.exe" C:\Users\Admin\AppData\Local\Temp\dab05827c1608d680f5a5990016c089d5f5bc9736a8f8cae2179f9b7ddecacbcN.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES9625.tmp

Filesize
1KB

MD5
52b2c6da060e58a339e6cfc663711cb9

SHA1
cad34f10bef73c340387ee96cc603de3afbbe0e2

SHA256
b06d90fa1c8d9db19f96b3bb09f02688e0467d3e642e14fb1d59b2b10ae14a67

SHA512
b7c37452367b8db592f756f3f93418e0a01ae8e594943a13300f62ac72a728ca1bf3223e488a387552ea2674437b0e578e0ef3488a3bb423a813ce61f2b3be0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mvjbtcmv.0.vb

Filesize
14KB

MD5
63a0a42df8da67469a3ab7257ab06631

SHA1
887ca1b6d6bfb19d43ff8165eb81ce742a659ec2

SHA256
8144111d7350a8918fb325b5c4598d57c141b5677c249a46a564fac413c7b3a9

SHA512
94cfdf96153c7010213f83e9664c47aa3b3dd1e9d58be6aad8a98c11574f7da9b512c449e25df8b1c16a5de7c318be54683072fcff6d045de0b67dce2a269964

Download Submit
C:\Users\Admin\AppData\Local\Temp\mvjbtcmv.cmdline

Filesize
266B

MD5
a4b805eb96f05ac54b6f5a8f5818e6f0

SHA1
0021ed5aa8ba6c11b07bc07f507e0cd2d297a986

SHA256
f8e26bfe01f67e56dd67332bb7eef83186b874fe40a41df0b763c676c2888ad2

SHA512
c092e2118b215674471fbb478f80bc28c0316bc500cf5b75be17c9403ee5aa7cee97f1dbc5b363db22c4c0aa572545597a236546c9e110fbe2c95a57e86879cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9366.tmp.exe

Filesize
78KB

MD5
e082fb2658591dc24cd04ad7a42b1d25

SHA1
1f621ae11f0b9c453421976ee5b3f9040ba96076

SHA256
8ec384e11bbd60b634e1135e4dc1cc831cbf8818a5843c4dd6f0d9c01f6e1386

SHA512
49eccaac59afafdceef8499c821cc102d8dc105927ed3dfdf4f34d6871425bf2493310f8547e274da9765c756b3a08d9c323607a4ef424642ce25855134b096e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcCC936193E41143118ED26A458965F71D.TMP

Filesize
660B

MD5
163649c1958c8ff1534b91703fd2951c

SHA1
d867adf861d55b3a85fce56e2bf9191d4606ad15

SHA256
dfc6a0c3be19d4c94c1cd199f5e8d03b26804403023ab725f45302b27dc3f8d7

SHA512
a2e6d72d4eb00bcaac6c68ac81db218ace5f1449e6d85e1b535ab091e4fa138dab37800424371c0df075f537164a312fc127dc652ed159a8ec88992430018d3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
4f0e8cf79edb6cd381474b21cabfdf4a

SHA1
7018c96b4c5dab7957d4bcdc82c1e7bb3a4f80c4

SHA256
e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5

SHA512
2451a59d09464e30d0df822d9322dbecb83faa92c5a5b71b7b9db62330c40cc7570d66235f137290074a3c4a9f3d8b3447067ed135f1bb60ea9e18d0df39a107

Download Submit
memory/2004-25-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/2004-23-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/2004-24-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/2004-27-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/2004-28-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/2004-29-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/3416-18-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/3416-9-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/3612-0-0x0000000074DD2000-0x0000000074DD3000-memory.dmp

Filesize
4KB

Download
memory/3612-22-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/3612-1-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download
memory/3612-2-0x0000000074DD0000-0x0000000075381000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads