metamorpherrat | 5307ce2390d7c4bfba56c3f519dfcf29d7a5e1752150847c43b6d94d5a9e0ffb

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90ed1454b881cba4ecd9b651325d4638.exe
Size

78KB
MD5

90ed1454b881cba4ecd9b651325d4638
SHA1

26bbba7eac5362ddc6298af80061c885f1c9b2e7
SHA256

62ac8026e108b28ce691b285d53374e0434ae08dea0fd8837f239c6858b40be0
SHA512

bad4b9e2b79f8894c5ffdf943d2bbee79e42b25bcb42515bd50c7fd46d7de8c129571f285a5c0823399b85d1edf99966e775aad82c71c20be7406198823a845b
SSDEEP

1536:i5jS6dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN6e9/Hp13l:i5jS1n7N041Qqhgl9/H5

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	90ed1454b881cba4ecd9b651325d4638.exe

Executes dropped EXE 1 IoCs

pid	Process
4692	tmpB14E.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\""	tmpB14E.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90ed1454b881cba4ecd9b651325d4638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB14E.tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	90ed1454b881cba4ecd9b651325d4638.exe
Token: SeDebugPrivilege	4692	tmpB14E.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1348	2624	90ed1454b881cba4ecd9b651325d4638.exe	89
PID 2624 wrote to memory of 1348	2624	90ed1454b881cba4ecd9b651325d4638.exe	89
PID 2624 wrote to memory of 1348	2624	90ed1454b881cba4ecd9b651325d4638.exe	89
PID 1348 wrote to memory of 2948	1348	vbc.exe	91
PID 1348 wrote to memory of 2948	1348	vbc.exe	91
PID 1348 wrote to memory of 2948	1348	vbc.exe	91
PID 2624 wrote to memory of 4692	2624	90ed1454b881cba4ecd9b651325d4638.exe	92
PID 2624 wrote to memory of 4692	2624	90ed1454b881cba4ecd9b651325d4638.exe	92
PID 2624 wrote to memory of 4692	2624	90ed1454b881cba4ecd9b651325d4638.exe	92

C:\Users\Admin\AppData\Local\Temp\90ed1454b881cba4ecd9b651325d4638.exe
"C:\Users\Admin\AppData\Local\Temp\90ed1454b881cba4ecd9b651325d4638.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yng741k4.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB239.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE342457CAC404924836E61B5CD2F9B5D.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2948
- C:\Users\Admin\AppData\Local\Temp\tmpB14E.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB14E.tmp.exe" C:\Users\Admin\AppData\Local\Temp\90ed1454b881cba4ecd9b651325d4638.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESB239.tmp

Filesize
1KB

MD5
d276c7b8dabeda2a49c1ca93eb253149

SHA1
5f791bb0f98ee5646cdcc64727a7d5f935cb1c5b

SHA256
f39ad3fc9cb9670c94dd3a724cfdaa24d74839e03c461bd329c71826b22e057b

SHA512
60a7e28e0cf4ab20996c3e51a274cf153baec993303a7a92aee28ae7917bf859586cfb3f78a555bbc720675dafd296b7451227fd0f9462a163b3e6fb5c12c915

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB14E.tmp.exe

Filesize
78KB

MD5
bfd17df6f3bd18b0e8db297950f22c60

SHA1
b3de370dc1a48ed8b2d99613eb0d783f2d7cd993

SHA256
d2b7ed4ea060f7646469baf19b26ffcad1d9650c4eecd8708592fb9d528f8bea

SHA512
239a8fae2ea017ecf4a86777dd3d1f415f4fe19b01aac53c9495dfeeba4efa352bffc405bac13a208df57fc79fe1a5f7261a81426f153fed5a5760395a383434

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcE342457CAC404924836E61B5CD2F9B5D.TMP

Filesize
660B

MD5
ec47847ee3468ed598da64b2bdbbb9aa

SHA1
0499ce72e7b6787cd5cd1d2c6d88e94ff89ec8c1

SHA256
41da0ad5372654b809dbd04232ccc415ce590f6cdebd8e639a4bb110b4f627b5

SHA512
a3a0198ad16e5af8e83c9bec6c1ad87ce3587269c730cf2f88c9935de2bd898941549bcdb800ad818706c79f5458b4bf17539780e263abdfd2eecf5bb3d5819c

Download Submit
C:\Users\Admin\AppData\Local\Temp\yng741k4.0.vb

Filesize
14KB

MD5
640a9287a271b38edbe374879869cc7b

SHA1
660e51266bac2d8a4774fd032fc58401a8dbde1b

SHA256
88dfdd48712fea4f86539579e1e26fb0496e4fc9b626b0715815d09b73363da2

SHA512
eb069e78c90104f38c999025247123e38cada406edde8f78f043ee26f4cef24ae2d8b2b14269d31d511cf365c40401913f71e535437a3f899f3f2dbb1a7dbd23

Download Submit
C:\Users\Admin\AppData\Local\Temp\yng741k4.cmdline

Filesize
266B

MD5
0dd28adb8dad22df863296f00e530698

SHA1
86bcc8a5097e5231a44ba58b937f22ac560ee17f

SHA256
40b627d0dfe94c8cfe0c7feb40dfc4a0cf4b8c6365aa493e467e49ea31181684

SHA512
c9e2c78650238c535c757a20e91a5ae0167f28a2736090854e1e90997f20ba56c92cfda631cdb7de942bdd6d3d4a7e1cf06ecb040b0c6dc9cf396e577ef5b336

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
aa4bdac8c4e0538ec2bb4b7574c94192

SHA1
ef76d834232b67b27ebd75708922adea97aeacce

SHA256
d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

SHA512
0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

Download Submit
memory/1348-18-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/1348-8-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/2624-2-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/2624-1-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/2624-0-0x00000000752B2000-0x00000000752B3000-memory.dmp

Filesize
4KB

Download
memory/2624-22-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4692-23-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4692-24-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4692-25-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4692-27-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4692-28-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4692-29-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads