metamorpherrat | 5307ce2390d7c4bfba56c3f519dfcf29d7a5e1752150847c43b6d94d5a9e0ffb

Analysis

max time kernel
150s
max time network
160s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90ed1454b881cba4ecd9b651325d4638.exe
Size

78KB
MD5

90ed1454b881cba4ecd9b651325d4638
SHA1

26bbba7eac5362ddc6298af80061c885f1c9b2e7
SHA256

62ac8026e108b28ce691b285d53374e0434ae08dea0fd8837f239c6858b40be0
SHA512

bad4b9e2b79f8894c5ffdf943d2bbee79e42b25bcb42515bd50c7fd46d7de8c129571f285a5c0823399b85d1edf99966e775aad82c71c20be7406198823a845b
SSDEEP

1536:i5jS6dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN6e9/Hp13l:i5jS1n7N041Qqhgl9/H5

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Executes dropped EXE 1 IoCs

pid	Process
2824	tmp8A55.tmp.exe

Loads dropped DLL 2 IoCs

pid	Process
2604	90ed1454b881cba4ecd9b651325d4638.exe
2604	90ed1454b881cba4ecd9b651325d4638.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmp8A55.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp8A55.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90ed1454b881cba4ecd9b651325d4638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	90ed1454b881cba4ecd9b651325d4638.exe
Token: SeDebugPrivilege	2824	tmp8A55.tmp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2964	2604	90ed1454b881cba4ecd9b651325d4638.exe	29
PID 2604 wrote to memory of 2964	2604	90ed1454b881cba4ecd9b651325d4638.exe	29
PID 2604 wrote to memory of 2964	2604	90ed1454b881cba4ecd9b651325d4638.exe	29
PID 2604 wrote to memory of 2964	2604	90ed1454b881cba4ecd9b651325d4638.exe	29
PID 2964 wrote to memory of 2792	2964	vbc.exe	31
PID 2964 wrote to memory of 2792	2964	vbc.exe	31
PID 2964 wrote to memory of 2792	2964	vbc.exe	31
PID 2964 wrote to memory of 2792	2964	vbc.exe	31
PID 2604 wrote to memory of 2824	2604	90ed1454b881cba4ecd9b651325d4638.exe	32
PID 2604 wrote to memory of 2824	2604	90ed1454b881cba4ecd9b651325d4638.exe	32
PID 2604 wrote to memory of 2824	2604	90ed1454b881cba4ecd9b651325d4638.exe	32
PID 2604 wrote to memory of 2824	2604	90ed1454b881cba4ecd9b651325d4638.exe	32

C:\Users\Admin\AppData\Local\Temp\90ed1454b881cba4ecd9b651325d4638.exe
"C:\Users\Admin\AppData\Local\Temp\90ed1454b881cba4ecd9b651325d4638.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1cyf0ppj.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D91.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8D90.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2792
- C:\Users\Admin\AppData\Local\Temp\tmp8A55.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8A55.tmp.exe" C:\Users\Admin\AppData\Local\Temp\90ed1454b881cba4ecd9b651325d4638.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1cyf0ppj.0.vb

Filesize
14KB

MD5
3fa08b8420aff83afc551155f01de2f2

SHA1
e307908857d09c2a08bb1f691119ff2c92403c00

SHA256
23bd9a27f62096466c5bca123e7cee83bb31372ad60cf8f1c0915ddd6f309100

SHA512
df45dc0285f70f645189c16c10f2446863e33b728158a271ba6a8a150545cda36e9edfcb83654e1c8fb0142a485f24bf1059e1bc9116eac3f2e9f214691d1f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1cyf0ppj.cmdline

Filesize
266B

MD5
2a8039bede9a9d773e110998ac033958

SHA1
b12f94741d4a663c1efc1f911d49726b7f60aa25

SHA256
f0afbd1287a331baea3714c6f8f240178ac007e7de7a4a82fd5315ae04557c45

SHA512
c624da6f8c8b596037cccda4ae6a3f377c1bee0f78016d4fc8b47839747dc49e18240bb837dc6fdab9ce1f09b1714e613ebbc7670481815aa5dc40e97e2d4db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8D91.tmp

Filesize
1KB

MD5
7109d95a41cba45fed8690f907c5474a

SHA1
7cc54baaf5f8dc2079785dfc97b956d6af5f8aea

SHA256
6a515dfa70664a1a93f6da9bbe2a8394a7bdc9af51127e61d26c099acb898720

SHA512
1f593cec0231f822e5d91bd5cd4740d4ee3f14181634da234f28469a2a52e6012bfffd46aaa25f21e948318e11afa7159a8901df804a83529b5008c0654c57ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8A55.tmp.exe

Filesize
78KB

MD5
97b4932b3927c1bab04b25b4150a75fe

SHA1
7bd961f091f7df453b97d7925ff0738e286e71b7

SHA256
3f6703286adb65f5d063d2bf3ce792f1f7729fb09d0b2b3f3f196fd1632664e5

SHA512
fc4f3f2d202e2eb845b6a505804d0ca9aa002276854523fea454c5c7212fba3ccb096c853dd247134dd3138ec9d7ff82526d8d1673912871b57afc8b1a09fda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc8D90.tmp

Filesize
660B

MD5
fafcc1fc5bb6aa02166d9ea5100f57fb

SHA1
1e3d40835be94e2897e563519fddb641ba102853

SHA256
12e2945f802650885c3fbc1fb39ca413f87d262b7bbb6e6d846a146081280895

SHA512
3c02e5eb34032d47f613e19f2e8ccde43150500549f81e6721ac7a1b7953a7cfec86e3a6b74cfc057d2a2a61d6eaef060aa426899438c706bcab0a5d9a2d8574

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
aa4bdac8c4e0538ec2bb4b7574c94192

SHA1
ef76d834232b67b27ebd75708922adea97aeacce

SHA256
d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

SHA512
0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

Download Submit
memory/2604-0-0x0000000074B31000-0x0000000074B32000-memory.dmp

Filesize
4KB

Download
memory/2604-1-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2604-2-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2604-24-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2964-8-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/2964-18-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads