metamorpherrat | 81e6145cbc93443083f2398466f3a7d39c52dcac816b92b4619576ce531c0624

General

Target

JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
Size

80KB
MD5

5da3837530dd6b1a9666ea002aef5238
SHA1

41893ba57e61f8b177775c4d8ff982a8ec73e94e
SHA256

81e6145cbc93443083f2398466f3a7d39c52dcac816b92b4619576ce531c0624
SHA512

666fd1978741d8b4d6360bf46d93e957af5931f1777021e75ed403a125d5d9d0123410b41c88329d4595c587b125a2e85e09ec5e0f5498651d690ff344f64cd4
SSDEEP

1536:9HFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLg39/CF1b:9HFo8dSE2EwR4uY41HyvYLg39/Cz

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2752	tmp37A4.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp37A4.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp37A4.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
Token: SeDebugPrivilege	2752	tmp37A4.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2780	3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe	30
PID 3044 wrote to memory of 2780	3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe	30
PID 3044 wrote to memory of 2780	3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe	30
PID 3044 wrote to memory of 2780	3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe	30
PID 2780 wrote to memory of 2664	2780	vbc.exe	32
PID 2780 wrote to memory of 2664	2780	vbc.exe	32
PID 2780 wrote to memory of 2664	2780	vbc.exe	32
PID 2780 wrote to memory of 2664	2780	vbc.exe	32
PID 3044 wrote to memory of 2752	3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe	33
PID 3044 wrote to memory of 2752	3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe	33
PID 3044 wrote to memory of 2752	3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe	33
PID 3044 wrote to memory of 2752	3044	JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bjxvuivt.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38BD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc38BC.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
- C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5da3837530dd6b1a9666ea002aef5238.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES38BD.tmp

Filesize
1KB

MD5
688f8ca63a4366d61fd9d22f63ab0c5a

SHA1
cf6218f7700c973faf31b993b0d228c12703081d

SHA256
671bce54fb69abef3092bb0191d1bbd37485a5a98406ecc7d49803a77b4b7afa

SHA512
19e9fd873367fe902cba501bd79105d082f9b076de83872a4d3da16fa948e1edc506dc2bc0f6507e343c97e97814f630bef72641bc8bed18a98236871e9f440e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bjxvuivt.0.vb

Filesize
15KB

MD5
940d157842759692a6484444fa267f81

SHA1
71ae48d417e06c3597d3c7b0db33ef4850377b90

SHA256
8666e39ef64250cc97f9a7519a8095267a841e1a8498a293501ebfbc886595ca

SHA512
1c18b5efe5d87465c53f23e266c5f9e5b1794c4b2985163649d37cf8eb74089924f2f4d058dfa8f21be70870c590761c912713d7efdb53e57cdd01e329ac2e80

Download Submit
C:\Users\Admin\AppData\Local\Temp\bjxvuivt.cmdline

Filesize
266B

MD5
88511e980322352dafcaccc7e8e603ca

SHA1
06613e76a0b99f03d246cb6d2bdca0f07c526b84

SHA256
ebdeb2f568ca90724ef6491a39a1b2eb1d917a8a62aa0e0c81522d6f99fea124

SHA512
e5d5f4d62f462fcbf57544ec32fb67f0fa45074a5fcc65555e3df1d2b169db0acdf62613ce2169ef6ba68b34dccabe608b316e8b6f9f5d26f271096ae27fe506

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp37A4.tmp.exe

Filesize
78KB

MD5
396f360a9345d1360d34c0ca39d3fd24

SHA1
6e333e92e9fae9fbc98ec7f4c923e5f6731f4a8f

SHA256
e583078ae31b379e7f01276b4f3abbca722c9346c14180401d12b71aef4a9ce6

SHA512
337e1419b01e78bf8d0851494e8e7f0ca546c2027bbeb2bbad1de50090d80253c344562a9b431a445b7a19de992f2a4c05c35bb23ae9b6d88f0383101dd0ee6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc38BC.tmp

Filesize
660B

MD5
7e41bf3215bc8a6d5c8bba70735e42fe

SHA1
2a74cd4a3cbc0ae8084a4939553cc69ee8a86997

SHA256
1b6e40e3b18580fab7f4be3c5d5a06560d373c4671e489bd2bf1313567761154

SHA512
f7941273990f07659723fb4a70b49902bc6245b9eb2769599ae5b49b1f1cdafb4a7f788f26a87288d3cc3675a03501d41b89aae2b1942357ba3c022d9f0701b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
6870a276e0bed6dd5394d178156ebad0

SHA1
9b6005e5771bb4afb93a8862b54fe77dc4d203ee

SHA256
69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

SHA512
3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

Download Submit
memory/2780-8-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/2780-18-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/3044-0-0x0000000073FA1000-0x0000000073FA2000-memory.dmp

Filesize
4KB

Download
memory/3044-2-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/3044-1-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download
memory/3044-24-0x0000000073FA0000-0x000000007454B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads