Analysis

  • max time kernel
    140s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:14

General

  • Target

    959c2d37a1e94337957c5323aab9bf19.exe

  • Size

    78KB

  • MD5

    959c2d37a1e94337957c5323aab9bf19

  • SHA1

    c1008d70530f9b443d3fd3bf777d55c7bcbb34cf

  • SHA256

    aaeda31514ca109b3a85002648761d73f97e281fcc8171ef5300c68950658507

  • SHA512

    991c2d17b495f01d2678340f7709f35d8baa13aac185b489ec74a72cc9d442b9e801dc90605d8da482b2933b1fe1efdf2b251ae04f6e03d4e0d9ba1ce7a4c2c9

  • SSDEEP

    1536:wRWtHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtRP9/o1xc:wRWtHa3Ln7N041QqhgRP9/j

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\959c2d37a1e94337957c5323aab9bf19.exe
    "C:\Users\Admin\AppData\Local\Temp\959c2d37a1e94337957c5323aab9bf19.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rfv8osyo.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2364
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEACD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEACC.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2144
    • C:\Users\Admin\AppData\Local\Temp\tmpEA5F.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpEA5F.tmp.exe" C:\Users\Admin\AppData\Local\Temp\959c2d37a1e94337957c5323aab9bf19.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RESEACD.tmp

    Filesize

    1KB

    MD5

    a0114a9024cfa5b168695377318637b2

    SHA1

    4cd7e2d9ac3e351450238c72458c686352d18295

    SHA256

    b4d31f39381e9ecdb5be0f5ac734d93e22cb7ae0faa49fd67bdf5cb16c294229

    SHA512

    cecf1dce422cb37e6a3e771f2230d956cbdc8574589f9eab4a517f6043afb3b00c14b30c3906b0355d3ce1eeea6b3cc309de4329772398c9e5b37fc2b9edfc9f

  • C:\Users\Admin\AppData\Local\Temp\rfv8osyo.0.vb

    Filesize

    15KB

    MD5

    2cd2e3ebb9c51cc19105fc301fa03306

    SHA1

    3b370d539844b039437ad5c6e35541ec8deff5f5

    SHA256

    035ad475dcd3103401c8d29a05e7c6e556f6d94138d76030c78c9cc60e3bc3f6

    SHA512

    1de38ac620978c601814d52e00e89153369c035def754ee3d023371a017cbbcac13ac182ea085ae6132bd6008f7e8676d6df70f433fde5e4a9deb3450746deed

  • C:\Users\Admin\AppData\Local\Temp\rfv8osyo.cmdline

    Filesize

    266B

    MD5

    6f77164965cc888ae50c91f6cb2dd0b1

    SHA1

    c9e02452cd30cea80fb4f3397deebe2ba58ab359

    SHA256

    f4cf6b33f1cf76f76f3914330598be12ec626ab872c9e5aacc107760b7f3de5a

    SHA512

    f2345f03daceb753ec7c05123c6d008c40dc80e71ee0adb232d6a6e4069a75d2cef2de6092861dc2af3698ae97a7b00510998f90adce02704747b6bcfc02ce35

  • C:\Users\Admin\AppData\Local\Temp\vbcEACC.tmp

    Filesize

    660B

    MD5

    7d137f3e38fa0e2299d95857d3224be2

    SHA1

    f50c1a2b8f112ed55ff9d259589cca4ed863b3da

    SHA256

    77e56cdaceb418427bb79ab86fe605ca79efe630a086d10cd67d5c68fb9041ef

    SHA512

    274f9faf2c081fd7b193de20d5c4ee5476cc8c36fdeaa6e81dc549cc50aa3d6eb4203a38fbcb09d3bdd9a8a808d936f48cbc41743a773302ac283e1915761d74

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    aa4bdac8c4e0538ec2bb4b7574c94192

    SHA1

    ef76d834232b67b27ebd75708922adea97aeacce

    SHA256

    d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

    SHA512

    0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

  • \Users\Admin\AppData\Local\Temp\tmpEA5F.tmp.exe

    Filesize

    78KB

    MD5

    b7140fe030ccbc2cda8b1f27c5782ba5

    SHA1

    4bd5632966e541b90df5ef0e910f7aff3feb2283

    SHA256

    f2a6550180a60c63eebf4b264b10ecf0d22d00c5851421776639d51a2cf1ec97

    SHA512

    759a411208527e4b494fc291e09ab5e62121c1625b876f7f4512f78af295c9bd8d5ad17acf919184d0ea1526b661ac742834db8d65ae54032200a22fa4ef1ac5

  • memory/1764-0-0x0000000074381000-0x0000000074382000-memory.dmp

    Filesize

    4KB

  • memory/1764-1-0x0000000074380000-0x000000007492B000-memory.dmp

    Filesize

    5.7MB

  • memory/1764-2-0x0000000074380000-0x000000007492B000-memory.dmp

    Filesize

    5.7MB

  • memory/1764-24-0x0000000074380000-0x000000007492B000-memory.dmp

    Filesize

    5.7MB

  • memory/2364-18-0x0000000074380000-0x000000007492B000-memory.dmp

    Filesize

    5.7MB

  • memory/2364-8-0x0000000074380000-0x000000007492B000-memory.dmp

    Filesize

    5.7MB