metamorpherrat | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6e297800457d823c0597e833d555135.exe
Size

78KB
MD5

f6e297800457d823c0597e833d555135
SHA1

bef99c4a2e1ad4c2c478f156089158cbc624f7d2
SHA256

da2a754ce56ec13af9f429d5dcd20ff88aadc429a1b0a74d68f217f87e31b42f
SHA512

69ae7dc2898887531ef8faa9740d56e6e40af3d0bafca4f2c78e4e4a37a643afa731985d9fbb9792ea61fd61927d043356a418be09b5ad1b48c73aec81af1790
SSDEEP

1536:7V5jSYLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6H9/0V1aj:7V5jS+E2EwR4uY41HyvYg9/0g

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	f6e297800457d823c0597e833d555135.exe

Deletes itself 1 IoCs

pid	Process
4512	tmpC67C.tmp.exe

Executes dropped EXE 1 IoCs

pid	Process
4512	tmpC67C.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmpC67C.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpC67C.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6e297800457d823c0597e833d555135.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	f6e297800457d823c0597e833d555135.exe
Token: SeDebugPrivilege	4512	tmpC67C.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 632	2572	f6e297800457d823c0597e833d555135.exe	89
PID 2572 wrote to memory of 632	2572	f6e297800457d823c0597e833d555135.exe	89
PID 2572 wrote to memory of 632	2572	f6e297800457d823c0597e833d555135.exe	89
PID 632 wrote to memory of 3940	632	vbc.exe	91
PID 632 wrote to memory of 3940	632	vbc.exe	91
PID 632 wrote to memory of 3940	632	vbc.exe	91
PID 2572 wrote to memory of 4512	2572	f6e297800457d823c0597e833d555135.exe	92
PID 2572 wrote to memory of 4512	2572	f6e297800457d823c0597e833d555135.exe	92
PID 2572 wrote to memory of 4512	2572	f6e297800457d823c0597e833d555135.exe	92

C:\Users\Admin\AppData\Local\Temp\f6e297800457d823c0597e833d555135.exe
"C:\Users\Admin\AppData\Local\Temp\f6e297800457d823c0597e833d555135.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\weprg18i.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC851.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCC6A05A996EB4018982B82A24381A6E2.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3940
- C:\Users\Admin\AppData\Local\Temp\tmpC67C.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpC67C.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f6e297800457d823c0597e833d555135.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESC851.tmp

Filesize
1KB

MD5
48b3f78d29ab32bfa0d14b0750a94465

SHA1
c41d69c5d7f96e65b368a284f6efd32579c223d0

SHA256
0e1429b9a22d63c6401ceb220fc2294b81cf4c0a283d4bcd00a2c8a9cfffe6b9

SHA512
8ef5de13800f662199834e7859405d999d42e45d53b164817b694438680253a5afbcd2e3fe5594f01f9cf5922d38d467faf813eea4492ad0834593d5a054b44b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC67C.tmp.exe

Filesize
78KB

MD5
20ce183681065d4c01fe07fd0def4dac

SHA1
2086c9372801e11e65e3dc7399b9e9d308fde7cb

SHA256
973598a12f91ca7c97c5f4027e5b564697c540dda07142e4015e4a219c223f8b

SHA512
96b949ada362d9f96de778afaffcb90419cea5641084c030b1165b7610a9b23f2ccc6765ed7b961e01f4ee2b1aa537d5dcda52ecebcaf217bd0b8c00bb0ae979

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcCC6A05A996EB4018982B82A24381A6E2.TMP

Filesize
660B

MD5
8e614d19151795fdbaf243f8e2caa4ce

SHA1
ee098cb271b2c1164c5f9fbf041780bf5e5c7b53

SHA256
2d0c602cd7185c41251ca90d7d5464bf0d2cecc5006a075357ee34c5d039f81f

SHA512
a6b15dbf5616e6d8b387aaa45e31ba3ccdb742f29a2fa8d2d1acc4f340d8339781880953e2425701f9322c1f071b5ee111f7b6d55d2282d8f772311a9248feeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\weprg18i.0.vb

Filesize
14KB

MD5
16dfbd946b34b3dd48ceb5c9d767c4f5

SHA1
c76f8403e9a136e24212b0acad9eaf504d9e186f

SHA256
572e29546cb030fbb7f62462dbfaaf946e61f4d8d3f7f4d2769161a75b301143

SHA512
e61b2537c373409ecc71e9787782648b59bec705eda024f1b43983032d7ed492be819b6ec06526558e23440e83e1e6993385ad2326e405ca680260b91d5f4c66

Download Submit
C:\Users\Admin\AppData\Local\Temp\weprg18i.cmdline

Filesize
266B

MD5
0d3b6a9b0ae0735d7b80a72dc21c4252

SHA1
8ba1b7a002720150d70d18a83c7e8cdda3df169a

SHA256
2ed0a95196f60a097d6654c5c3624f2f5be23b02a97e72d58b0092d856563d08

SHA512
a839c6df6edcb5aebefe724f4d3b6dd1e7f295a8d38f1b68f6966508d8e81c216ddae399b1050ad90a3a7b13d419845ff6d0950ddb530d8fe995e0038a2a8bdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
6870a276e0bed6dd5394d178156ebad0

SHA1
9b6005e5771bb4afb93a8862b54fe77dc4d203ee

SHA256
69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

SHA512
3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

Download Submit
memory/632-9-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/632-18-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/2572-0-0x0000000075322000-0x0000000075323000-memory.dmp

Filesize
4KB

Download
memory/2572-2-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/2572-1-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/2572-22-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/4512-23-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/4512-24-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/4512-26-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/4512-27-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download
memory/4512-28-0x0000000075320000-0x00000000758D1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads