metamorpherrat | cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267

General

Target

cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe
Size

78KB
MD5

0a2ce31e8654f4c3ba6d81bf7ac51e00
SHA1

a0844a42d36b88b78074e967f3f946761b48ad28
SHA256

cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267
SHA512

f8d20f0e97e3bc01c4480682f961378338a8d26f16a4b071eb572033ee0028920d006d5b78887c572b29eccdc2e491ee3dd87dc86ebf139dded1b9330ae0fe7c
SSDEEP

1536:OHFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtLQ9/hg1Kz:OHFo8dSE2EwR4uY41HyvYLQ9//

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe

Executes dropped EXE 1 IoCs

pid	Process
5016	tmp86B4.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp86B4.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp86B4.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe
Token: SeDebugPrivilege	5016	tmp86B4.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 1888	4148	cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe	87
PID 4148 wrote to memory of 1888	4148	cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe	87
PID 4148 wrote to memory of 1888	4148	cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe	87
PID 1888 wrote to memory of 5488	1888	vbc.exe	89
PID 1888 wrote to memory of 5488	1888	vbc.exe	89
PID 1888 wrote to memory of 5488	1888	vbc.exe	89
PID 4148 wrote to memory of 5016	4148	cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe	92
PID 4148 wrote to memory of 5016	4148	cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe	92
PID 4148 wrote to memory of 5016	4148	cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe	92

C:\Users\Admin\AppData\Local\Temp\cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe
"C:\Users\Admin\AppData\Local\Temp\cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w1nteo1i.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES878F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC0E0370FE95462E8296301EB44A13E5.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5488
- C:\Users\Admin\AppData\Local\Temp\tmp86B4.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp86B4.tmp.exe" C:\Users\Admin\AppData\Local\Temp\cf2f993cc96b70cf8e965dd1175460c4535fa6b839f8a88a617ba3fea46f4267.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES878F.tmp

Filesize
1KB

MD5
f4d79d4c613855511fe1e9585c3b589d

SHA1
70b19ed790faead75417ac6d7f3b3298d2ea572c

SHA256
f6abb98c76095e10b5719b331eafbfb177fb5fa8f248d29410abdf657b1abadf

SHA512
019b0ba4b5cb973b4aee164a335e8980d92cc856c2541009b569b110896e71dc4dda1bd7ce0068de4c9801f5641c40903338ee5eb4b1ac4391969aa1cefe2cc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp86B4.tmp.exe

Filesize
78KB

MD5
c02250f159cdb81c8d8070e87e47a8f8

SHA1
909b932a7c65413fb603573bcf98f0a56e6c4d7f

SHA256
a8236ce779031d678fda0518233d87c219e557860f7e6bf0ab4421ff92773170

SHA512
6a32ffc6a3ff927bf26f793c7282afca0fbe77d796891361cf7167321140ff87a08de1bb537cdd0ae7e0521f8ef44b49695608539ba66194b1190a1882ba6e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcC0E0370FE95462E8296301EB44A13E5.TMP

Filesize
660B

MD5
b79b051b2f199f30089f7f4777603718

SHA1
a7a73454fe917968dbe934ed667d046934f6c357

SHA256
e4d1795eb1e1fe81de920ad2c183f558c56085bae82070af72350bea240f06a8

SHA512
fb7001cc8a9ad480d8c041846c63b856ff6ab428a5863049d16b04c203543d3670ce6ac38ddcce4df186b72bff57801b8f2f6a52dfb3061344a9370992d0d888

Download Submit
C:\Users\Admin\AppData\Local\Temp\w1nteo1i.0.vb

Filesize
15KB

MD5
e8923f84a75b4007c5cec6a9889e2632

SHA1
3f7e81311b0f6fbec948c701f607bd2803674b0e

SHA256
c471aeb6ebecb003fc3a7db3538ea1994713e4e5e3f30c3fdd3d1106c8087c25

SHA512
5bd49f251baeeedb81b27ce605e5fe29786d4db1898be4529b41f326bad4fd64c065b3790dd37de1ea9f2c2300dad7e2813bb26b5a679d52d4f156351c255212

Download Submit
C:\Users\Admin\AppData\Local\Temp\w1nteo1i.cmdline

Filesize
266B

MD5
1bb5583413ebdcf5ba285a294fe4a4f6

SHA1
f97af96c7cb86765bebe4f4ab013af3078b80f49

SHA256
4ee0608c89060f923dd7c2f9b92de08962e372eb84ccfc1bf174b32477ba34ae

SHA512
bc4d8f694e930ac34b88ce0896911f8504ee93a957fef37deaa3ac8e1aaf171e9c2b07895bd23f2e1b26e063f2cfd9e716a53307686bffdb88f8393612a47d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
6870a276e0bed6dd5394d178156ebad0

SHA1
9b6005e5771bb4afb93a8862b54fe77dc4d203ee

SHA256
69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

SHA512
3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

Download Submit
memory/1888-18-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/1888-9-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/4148-1-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/4148-2-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/4148-0-0x00000000754D2000-0x00000000754D3000-memory.dmp

Filesize
4KB

Download
memory/4148-22-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/5016-23-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/5016-24-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/5016-26-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/5016-27-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download
memory/5016-28-0x00000000754D0000-0x0000000075A81000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads