Analysis

  • max time kernel
    111s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2024 02:22

General

  • Target

    a16151de5e9f8b0d7bcbf21125630d3abd2e15dde8dd0e42fe078528b4325d6d.exe

  • Size

    78KB

  • MD5

    bccfd2f671f53447e907641021e413ce

  • SHA1

    153f183bba5420907f35a4e1712c793e3bd5d9d3

  • SHA256

    a16151de5e9f8b0d7bcbf21125630d3abd2e15dde8dd0e42fe078528b4325d6d

  • SHA512

    8ec24938cd929119a71ccef094a4034f26a56c36c8fa5caa16aeca6f9321950b81108834608fba205f421f50cef6b995680a4fc0b29ad6fc2ef66fa2efa71bc0

  • SSDEEP

    1536:4PWV5jAXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQty6A9/o01Gtp:4PWV5j4SyRxvhTzXPvCbW2UI9/Mp

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a16151de5e9f8b0d7bcbf21125630d3abd2e15dde8dd0e42fe078528b4325d6d.exe
    "C:\Users\Admin\AppData\Local\Temp\a16151de5e9f8b0d7bcbf21125630d3abd2e15dde8dd0e42fe078528b4325d6d.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dpx5jof6.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD894.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD893.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2496
    • C:\Users\Admin\AppData\Local\Temp\tmpD71D.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpD71D.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a16151de5e9f8b0d7bcbf21125630d3abd2e15dde8dd0e42fe078528b4325d6d.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RESD894.tmp

    Filesize

    1KB

    MD5

    3ea12ea8480d5fba71b0860af42c42ce

    SHA1

    4bf9c777edb97c03064f379f3645897ecf521fb3

    SHA256

    9a4764b3dc41911a4101a1aec5b0d53d64e48adf5af70118cf6a8cfd9b16c207

    SHA512

    6006605a3356daefb05e486b6c7b1c01ef654fdc1275e53cdf582cdd1cca46cbc9ca48a3d34d0e0c403993fbc38f6988889142b0071c066784e562fcfdd4ece6

  • C:\Users\Admin\AppData\Local\Temp\dpx5jof6.0.vb

    Filesize

    14KB

    MD5

    6e641960caf881cd5d56fd020700c153

    SHA1

    535b9c261241a2acc0f26acc82450ceb1226c806

    SHA256

    0ee72e70147603b3bc48bf619d2e2c549c5d64a63c3001e38349bfddd4808304

    SHA512

    b9795f2fd304aee16fc13dd6fefaa11fbbbfe2cffd23fe2bc72be31001060fe6f28b6865db94387ffd599f9d1a9fd8464bd0c10891586a59a256b1a476047236

  • C:\Users\Admin\AppData\Local\Temp\dpx5jof6.cmdline

    Filesize

    266B

    MD5

    5682dd76868a1e2f1a38467a15fbf298

    SHA1

    b4ea82c6ee22b80ba877376ede9ed83037477073

    SHA256

    2c23e65589a0b5532be78be4d980a011081e7a44fdb24909ec3863cb3e060fc1

    SHA512

    10da9badd08d8f72c3bc5fb4b0efb9e794daef01b7890762a59040aa374d66840da9eaa9e4c6f08a0b267025ab4589ba4d2304f189bec3c1859628e46767f1f8

  • C:\Users\Admin\AppData\Local\Temp\tmpD71D.tmp.exe

    Filesize

    78KB

    MD5

    c38413a320d584d6691101821e912952

    SHA1

    714511bdfa159926b1a07b0a789b6d2fddf50b10

    SHA256

    5cf618f1e278c105ae6f3d18676ef91d06f7ab5aeac3030aaeb5439095240342

    SHA512

    33d95e9c4b7a5b69cef9db4e81ea641220ef3eab7c0cd30109f23555be6bb3b249c44c4900ecb0acf49d2046669690903bcd4d484f1b5aae8c25268b05fa279b

  • C:\Users\Admin\AppData\Local\Temp\vbcD893.tmp

    Filesize

    660B

    MD5

    2c54ce3eecf353602a972a0172e66756

    SHA1

    cd873a14ac00de4ec2ca9be47a98f90d4c1bd7be

    SHA256

    99ba2fd9a0303881cbf9846d3f266e74b0267e9a2c9a336be8cd310dafd8e0dd

    SHA512

    9ce12319334723ab186f1c2d0989ae7c0eac70610b7750ccd44ce667b5c202c03faae9372266e7ff49e4deead139226fa4cbc6dcdb5b1bcafbe9e6fab7e4ed2b

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    8fd8e054ba10661e530e54511658ac20

    SHA1

    72911622012ddf68f95c1e1424894ecb4442e6fd

    SHA256

    822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7

    SHA512

    c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

  • memory/2256-8-0x0000000074B50000-0x00000000750FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2256-18-0x0000000074B50000-0x00000000750FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2848-0-0x0000000074B51000-0x0000000074B52000-memory.dmp

    Filesize

    4KB

  • memory/2848-1-0x0000000074B50000-0x00000000750FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2848-2-0x0000000074B50000-0x00000000750FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2848-24-0x0000000074B50000-0x00000000750FB000-memory.dmp

    Filesize

    5.7MB