Analysis

  • max time kernel
    147s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:12

General

  • Target

    6f6b7ee9a4b8c657931ecaacd04849db.exe

  • Size

    78KB

  • MD5

    6f6b7ee9a4b8c657931ecaacd04849db

  • SHA1

    aadc1272891324493ad099c65e72a7bff8b2fd0b

  • SHA256

    11fb7846090fb2e23cba8a66b1e5e605072aab6580cb9103f9d3e89205826a1a

  • SHA512

    3c64218ed10eec552f198b17289aced5feaefec0c6ca8b1f25ed7f7e2cc1cab3fa98202f8bf0590810131c0cf12c38e5e9cd772170b5eb73873af7d8b12e7074

  • SSDEEP

    1536:NPWtHFo6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtD9/q1zv:NPWtHFo53Ln7N041QqhgD9/o

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f6b7ee9a4b8c657931ecaacd04849db.exe
    "C:\Users\Admin\AppData\Local\Temp\6f6b7ee9a4b8c657931ecaacd04849db.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xiqvsiae.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:696
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C95.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAA142FEC8BB64D019726D5DE85A8332.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2420
    • C:\Users\Admin\AppData\Local\Temp\tmp6B0E.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp6B0E.tmp.exe" C:\Users\Admin\AppData\Local\Temp\6f6b7ee9a4b8c657931ecaacd04849db.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES6C95.tmp

    Filesize

    1KB

    MD5

    b7b5aec373f1c427c32db99d367ac044

    SHA1

    1719fa8f7ec16dcb125c609b6bf2d4fba77c193f

    SHA256

    bff68e27af11bab0483ad6b9d950f9a4912023acf34075ca1622e9c3d3dd653d

    SHA512

    649207c43a0fcc69563ff6e8d6177e541baa2b1dfc45a1976ec692843778fa9e55ffd87e1eec7b612a55aee366f33b42a574c8f2f7dc11308f100b3e9effa3af

  • C:\Users\Admin\AppData\Local\Temp\tmp6B0E.tmp.exe

    Filesize

    78KB

    MD5

    f6090d3774cc1d88b0d44f145a341816

    SHA1

    ec996f14a60487dc22198e479f77861346968826

    SHA256

    77c913f237196ae8ba316ae8d0dab5ef3f1dcaaacd749d81ad67051a97e16d25

    SHA512

    9ef5dae1cb4f36f591d6e7c6f5b38e03cf8bff5827ef3e5fbe92cc87ca296fa401c79352d65a032ec7a02791038663cf385a86464c3d65dd0465b240d4750816

  • C:\Users\Admin\AppData\Local\Temp\vbcAA142FEC8BB64D019726D5DE85A8332.TMP

    Filesize

    660B

    MD5

    d1be7c345c5506fcd720c900c023776c

    SHA1

    a10fb5ce9fb9632d1ace6e18c8d1444976893a7e

    SHA256

    d565bef8c01437b5f9553915ae9238c02ead428db1e1ac816142a79d8a8f3063

    SHA512

    e438f8b4962ff02400b624cab326dc6900ff5e5d5083f63483710bca93815e4ea7a0b1053af2df084e7e9f92601de99e615402dffd27bbff1f43d95b3aece2d6

  • C:\Users\Admin\AppData\Local\Temp\xiqvsiae.0.vb

    Filesize

    15KB

    MD5

    5a72ac9a65b46ca6f2423cd93fedd4dc

    SHA1

    ec7c8a4e78ddde0a148b4b67ff75ad54e3f06f32

    SHA256

    30f5c4f5b9792e0597d1261656822da6dc7134b560952c67478f50417742e957

    SHA512

    35b1f462739210fe2d8feec44e7541a436a943fee89ffeb09b586cc9aaf447a32333028c7c275f2b07d2825167bebcf873d1c4332ab4b3e5c2fcdd81d9337b5d

  • C:\Users\Admin\AppData\Local\Temp\xiqvsiae.cmdline

    Filesize

    266B

    MD5

    9338f4df8791b5393bec8125087a2575

    SHA1

    b0fbfe64043c5a3accc4a006ae000116dd50764e

    SHA256

    96b64c8932dfd4543bd3e9f0724009b41617b7d15b32f1b0fe2c49b206b67524

    SHA512

    34020290e57b1e15029bd53737091094ac327e42c2c31a3764272b4cd29763f7e2ea2975e4198be701f0e1531b9b3c5e5b13406b26903b949816db5d0d35867e

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    aa4bdac8c4e0538ec2bb4b7574c94192

    SHA1

    ef76d834232b67b27ebd75708922adea97aeacce

    SHA256

    d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

    SHA512

    0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

  • memory/696-18-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/696-9-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3064-24-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3064-23-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3064-26-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3064-27-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3064-28-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4768-2-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4768-1-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4768-22-0x0000000075300000-0x00000000758B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4768-0-0x0000000075302000-0x0000000075303000-memory.dmp

    Filesize

    4KB