metamorpherrat | df025008bab8a9d1b780276526007d60abaafb894af2cca82bc633c715945ec5

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4502536cf49aa03ba4a7b695d7eaef2e.exe
Size

78KB
MD5

4502536cf49aa03ba4a7b695d7eaef2e
SHA1

5496f9936d988aef528f785ae7c3d3d4a1cd3e25
SHA256

7057a204b5f0886da9c758a11bc7587df6cd50cf6b1f47587d05aef2f3411027
SHA512

31be44ed80cb071345024ccafc841db6df4bdf8e0e1e3c9f041740d7209164bd7c6cd7325c0eab0bd812159fb8989da445e9ceaed43cadea5809b6205f60a784
SSDEEP

1536:HRWtHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtR79/cd1Up:HRWtHFq3Ln7N041QqhgR79/F

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
3004	tmpE6C6.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
816	4502536cf49aa03ba4a7b695d7eaef2e.exe
816	4502536cf49aa03ba4a7b695d7eaef2e.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmpE6C6.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4502536cf49aa03ba4a7b695d7eaef2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpE6C6.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	4502536cf49aa03ba4a7b695d7eaef2e.exe
Token: SeDebugPrivilege	3004	tmpE6C6.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2980	816	4502536cf49aa03ba4a7b695d7eaef2e.exe	30
PID 816 wrote to memory of 2980	816	4502536cf49aa03ba4a7b695d7eaef2e.exe	30
PID 816 wrote to memory of 2980	816	4502536cf49aa03ba4a7b695d7eaef2e.exe	30
PID 816 wrote to memory of 2980	816	4502536cf49aa03ba4a7b695d7eaef2e.exe	30
PID 2980 wrote to memory of 2908	2980	vbc.exe	32
PID 2980 wrote to memory of 2908	2980	vbc.exe	32
PID 2980 wrote to memory of 2908	2980	vbc.exe	32
PID 2980 wrote to memory of 2908	2980	vbc.exe	32
PID 816 wrote to memory of 3004	816	4502536cf49aa03ba4a7b695d7eaef2e.exe	33
PID 816 wrote to memory of 3004	816	4502536cf49aa03ba4a7b695d7eaef2e.exe	33
PID 816 wrote to memory of 3004	816	4502536cf49aa03ba4a7b695d7eaef2e.exe	33
PID 816 wrote to memory of 3004	816	4502536cf49aa03ba4a7b695d7eaef2e.exe	33

C:\Users\Admin\AppData\Local\Temp\4502536cf49aa03ba4a7b695d7eaef2e.exe
"C:\Users\Admin\AppData\Local\Temp\4502536cf49aa03ba4a7b695d7eaef2e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ash4ujit.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEACD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEACC.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2908
- C:\Users\Admin\AppData\Local\Temp\tmpE6C6.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpE6C6.tmp.exe" C:\Users\Admin\AppData\Local\Temp\4502536cf49aa03ba4a7b695d7eaef2e.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESEACD.tmp

Filesize
1KB

MD5
5ac97b027fa4e799aa9cef9eb8232a50

SHA1
89ffa69e8d959a61d04898271ce70ff9fe8810c7

SHA256
f502dcc2d441701a27ac44017702f3081110bdd85dbc89b70cc89c155fc48ad9

SHA512
234e7f88056981b1b7c94aceea45cc85f92ec5361fc29b6d72e5a04507cd1ee67a064a0955b5e5dc1703123abff4e70a50de1632cb4a0b9319390a6d7dacd629

Download Submit
C:\Users\Admin\AppData\Local\Temp\ash4ujit.0.vb

Filesize
15KB

MD5
aa714494a669a5dd2e2dada44621071a

SHA1
840957e5b14afbefd926998848015158d552ab6c

SHA256
8419a3643a76f2bf0432142e7205712aa54343ac9f8d4d18ad9db4967a87964f

SHA512
30156b03419513704fb34a171bc059e8d74e542b035499d2fd97dbf00602785067a8322338ef7e24d3531442064e1d2527111149a610ed30e108cb6e40b54180

Download Submit
C:\Users\Admin\AppData\Local\Temp\ash4ujit.cmdline

Filesize
266B

MD5
581673014ba21c12c8ad40b87515f9f7

SHA1
9f5586b786c0ff551ea15d865837f7b4b98ede3e

SHA256
8081b355be54bc2a4361394e5d264b5d8db512d1413e0e75f2658e38fc83856b

SHA512
acfc2be56e71b4b9d652a810c1378645d0e5df87f1eacb339f5e2b84329edf4310437f81ed5f201abaff54e8f48e58da019ee2b67d5b965fa93650521592c616

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE6C6.tmp.exe

Filesize
78KB

MD5
d904cb07a7d4def2f611d29749aa7e3e

SHA1
83d13bdc69d6482fd1abfbcf85a91d3c388d2105

SHA256
57a3fe8aa158715a2ab54fb16ada76e512d847d5a2af4dddab6320cfbe4c69de

SHA512
2fd93b1a9c8996b4ea7f99841a0736a1d07a4983f5706d673c91e916d8b9ae8e62384c147aa3e42df1ad82047cac93d706bd9245d2346e3ffe6e71706d750073

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcEACC.tmp

Filesize
660B

MD5
b99169d2ce7ed26fc8fd322c9f1099d4

SHA1
a0ab219a1d440329a205151d96c7dfa0690561de

SHA256
c44effe90412354b51376ccf71c32805ba4e5874b4034779dfed09c306d97c03

SHA512
cd20a85d127cac1af088b24c91c54a0e498f5d406ac3bbc47d3f865fb3c322ae65cb49374191776b13427d70b6d02f603c41b55f948d551fdd64699936b43a7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
aa4bdac8c4e0538ec2bb4b7574c94192

SHA1
ef76d834232b67b27ebd75708922adea97aeacce

SHA256
d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

SHA512
0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

Download Submit
memory/816-0-0x0000000074621000-0x0000000074622000-memory.dmp

Filesize
4KB

Download
memory/816-1-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/816-2-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/816-24-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/2980-8-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download
memory/2980-18-0x0000000074620000-0x0000000074BCB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads