Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:14

General

  • Target

    96959cb1423fd801a2e3d718868a3776.exe

  • Size

    78KB

  • MD5

    96959cb1423fd801a2e3d718868a3776

  • SHA1

    65d1736c9b979158bbfd4c1674f91fb034506eef

  • SHA256

    1905c3deaf30debadbb9311cd746db562d2c92f17ff356b6a66d9e448fc7ce6e

  • SHA512

    1ff6b163e10a01f18d28d5be955665324e63606ed380b15ca66943b1547f366f7713b291ceb48a42b02d7912b1f3ee3a1077f0d0ebec28eedd0579627609df28

  • SSDEEP

    1536:vsHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtD9/213n:vsHY53Ln7N041QqhgD9/Y

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96959cb1423fd801a2e3d718868a3776.exe
    "C:\Users\Admin\AppData\Local\Temp\96959cb1423fd801a2e3d718868a3776.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h_v4h0au.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7263.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7262.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2940
    • C:\Users\Admin\AppData\Local\Temp\tmp6D25.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp6D25.tmp.exe" C:\Users\Admin\AppData\Local\Temp\96959cb1423fd801a2e3d718868a3776.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES7263.tmp

    Filesize

    1KB

    MD5

    bfd73798e0edf9cf300b47dfe82ad012

    SHA1

    5f0f5c9b52ec1162d8da8d1e31f5f7c72e2b212d

    SHA256

    d89ba12a8dfc52f5b6602e2d7cdff11220323108e1d9db02ecd03bafb64c8c83

    SHA512

    621b262abf31e6c4bb817e226fed7dde78d36c4c97ad24896cd0f7ab421fd6186adf3b5f94ef7a85d6d3dbbf1acececb853d060bce0bb62a098ed5bee64102a0

  • C:\Users\Admin\AppData\Local\Temp\h_v4h0au.0.vb

    Filesize

    15KB

    MD5

    a829406edf472dbe80d9f54dadec99bb

    SHA1

    d5a74e9d983968dee27d0506d1cac8b3d23abb30

    SHA256

    564c257992da9fc09d1249ce9888cb35c9c1cbfe0a2a0159009d8471376fe6fa

    SHA512

    5ac3a779a5443993f4977990959fa13b428fde4a64486182a3a809b90a05e742566336b7aae78d5b9055b01ef7007803f769914f9cbeb3efe889ba187dbd956c

  • C:\Users\Admin\AppData\Local\Temp\h_v4h0au.cmdline

    Filesize

    266B

    MD5

    dc1ac27a8b84703434281ad517dc0fd9

    SHA1

    8a34db82f5796fa9fbf6fe6df4c29c33888e4b0a

    SHA256

    1ace80c17165a66a82a1613db494c3f77442a608b0901db2527114dd251643f9

    SHA512

    b40b04d8da0dfef4096760699ca68eca0209a617486bb9d6c10d1111bbbcbbbd5ff6c2876757d5f09637382383dc7401bcf087e8d1fc4c139774cea4d343f141

  • C:\Users\Admin\AppData\Local\Temp\tmp6D25.tmp.exe

    Filesize

    78KB

    MD5

    1e157dcaa3a28611ae87ff187ce808ff

    SHA1

    1b9f23aefa1381d6c3c0b4b14b0f626d790de54e

    SHA256

    3e80cd74b73167a9fe75d541d8e28f9d93af497e554f51d96b15004c1c2b39ba

    SHA512

    ea4a3dc1883e7375be5bd63d98453b9e9f1cb6f36afd77ea5ea4cb6ac70f7eb3df4cf9f471db6c05ae41c48028711d44dd3dd73d56d0c84a93352a1fe1770863

  • C:\Users\Admin\AppData\Local\Temp\vbc7262.tmp

    Filesize

    660B

    MD5

    d0319fdf5a4ecc8862be5bd3140d30e4

    SHA1

    5a44a39b292b0d9b36120dddd5f1b2c224ffdad6

    SHA256

    e0c200650b5c1b9c96fe531e4c17e423126aeef3957442b76eb95729b5994410

    SHA512

    9381ab1bbc3936090427021710843c1cc7acf5db1f2f66c7ef0b3b57ab3a366794167ff15237e9c04c9071c257d9f63d5b204f28bbb589602d103a6d000882b0

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    aa4bdac8c4e0538ec2bb4b7574c94192

    SHA1

    ef76d834232b67b27ebd75708922adea97aeacce

    SHA256

    d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

    SHA512

    0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

  • memory/2088-8-0x0000000073F00000-0x00000000744AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2088-18-0x0000000073F00000-0x00000000744AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2904-0-0x0000000073F01000-0x0000000073F02000-memory.dmp

    Filesize

    4KB

  • memory/2904-1-0x0000000073F00000-0x00000000744AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2904-2-0x0000000073F00000-0x00000000744AB000-memory.dmp

    Filesize

    5.7MB

  • memory/2904-24-0x0000000073F00000-0x00000000744AB000-memory.dmp

    Filesize

    5.7MB