metamorpherrat | 93951e96c85118f93305b89aebdef525cb3acb9253a0b6191349c5a16df88964

General

Target

f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe
Size

78KB
MD5

f367af0d73ba9c364b37d6733a123ccf
SHA1

1c18929583cb892574158bd950f2162c8c5dbbb7
SHA256

93951e96c85118f93305b89aebdef525cb3acb9253a0b6191349c5a16df88964
SHA512

ebbcc1e6bf36241bbb426c8fdb7e9291e07ab1943c7c8e4a66385f84139fd2d64c486ac74cdf7f5d850d3a3438ac847c9896d481e9e9d9075197f3f539d53c74
SSDEEP

1536:xHF3rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQt79/g1oN:xHFbdSE2EwR4uY41HyvY79/F

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
232	tmp8F4F.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp8F4F.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8F4F.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe
Token: SeDebugPrivilege	232	tmp8F4F.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 4612	3660	f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe	83
PID 3660 wrote to memory of 4612	3660	f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe	83
PID 3660 wrote to memory of 4612	3660	f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe	83
PID 4612 wrote to memory of 2024	4612	vbc.exe	85
PID 4612 wrote to memory of 2024	4612	vbc.exe	85
PID 4612 wrote to memory of 2024	4612	vbc.exe	85
PID 3660 wrote to memory of 232	3660	f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe	86
PID 3660 wrote to memory of 232	3660	f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe	86
PID 3660 wrote to memory of 232	3660	f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y2u1uyvz.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9078.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc92AC85706814D0EB5902B7FBF43B1CF.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2024
- C:\Users\Admin\AppData\Local\Temp\tmp8F4F.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8F4F.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f367af0d73ba9c364b37d6733a123ccf_JaffaCakes118.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES9078.tmp

Filesize
1KB

MD5
ab607b005636549edf9100d1f420ff7c

SHA1
7052ad038d76cc59cf649d62d6a391855613fd63

SHA256
4aeb7efc1aa94059d26e2dc57e6d4fb75b556247c169995ba98946c97f6df57a

SHA512
e3c8781024567359426529d46a911679df16b1a0bdd80152dd5b5a66cd340be553056d0da57457ea4447c5200008da496496f32560269ce7ccc91508378d86da

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8F4F.tmp.exe

Filesize
78KB

MD5
9e7180b8fb4ab3601dd95be03d70a8c2

SHA1
93ee85f64d9a60e208ad55e017c6ab71eb576f8a

SHA256
442c23776d1a191adbdfb30fbf92b4a5aa1749fd1d856362355d7f5eb34b6af4

SHA512
3f1c9ab26615e14fa3f3d267381d0cb8bcfc729a274fc975d178ad0acdcf6bce87972bc1101411933e63a652321e958aa27292fa88913e0e7e956def2c1ea22a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc92AC85706814D0EB5902B7FBF43B1CF.TMP

Filesize
660B

MD5
d12b12ee8e2463aa9e06ffc403d04bb9

SHA1
94ecf627b71a047777661c7429d04cabf7ea1b17

SHA256
8381de3f8bd6985dcb780b9350d345465f4b0651a41ef5b4d0cd3b08a40a69e6

SHA512
97645255c2626ca4a0e724f7fe322cffbd89d83c9cdc527698ddad0f8071a90c967918f885666cfcddf601b8947deb669dd0e78a6b4af4a76344e947584eb31d

Download Submit
C:\Users\Admin\AppData\Local\Temp\y2u1uyvz.0.vb

Filesize
15KB

MD5
91ec03b1f64925551679de593669171b

SHA1
28e678569efdb918a7760e833cdb46149c593694

SHA256
acf36519154bcf87f8428bc183909281c308a1aa76dcac5e32ec0f50a482c8ca

SHA512
64c3f412bdec477072a03b3c83a6797d0a2ddcddcb9fc4a318e461edda472414e86730bc63a09842e1b968c287217ed8a9813c686b81bacc22e2daaa123c2ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\y2u1uyvz.cmdline

Filesize
266B

MD5
453a4aa0cc345f6b2eca9f034506b910

SHA1
b83996f275144f752dc7fb9dcd058947e31b0a4e

SHA256
3c49e1fafee2229d15c80b2f6d7b6e156ecad8ee8f28846d9493d1995c1183d6

SHA512
93e1867943fe3d579cf48be102a1ae872c8931d6d252065f587c5070a42a297a5045f6e3e206b3e1273a1019f35cd2a696f7f8d13bc64a826f6b0deae88aeba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
6870a276e0bed6dd5394d178156ebad0

SHA1
9b6005e5771bb4afb93a8862b54fe77dc4d203ee

SHA256
69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

SHA512
3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

Download Submit
memory/232-23-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/232-24-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/232-26-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/232-27-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/232-28-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/3660-2-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/3660-1-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/3660-22-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/3660-0-0x0000000074F52000-0x0000000074F53000-memory.dmp

Filesize
4KB

Download
memory/4612-8-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download
memory/4612-18-0x0000000074F50000-0x0000000075501000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads