Analysis

  • max time kernel
    138s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:14

General

  • Target

    959c2d37a1e94337957c5323aab9bf19.exe

  • Size

    78KB

  • MD5

    959c2d37a1e94337957c5323aab9bf19

  • SHA1

    c1008d70530f9b443d3fd3bf777d55c7bcbb34cf

  • SHA256

    aaeda31514ca109b3a85002648761d73f97e281fcc8171ef5300c68950658507

  • SHA512

    991c2d17b495f01d2678340f7709f35d8baa13aac185b489ec74a72cc9d442b9e801dc90605d8da482b2933b1fe1efdf2b251ae04f6e03d4e0d9ba1ce7a4c2c9

  • SSDEEP

    1536:wRWtHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtRP9/o1xc:wRWtHa3Ln7N041QqhgRP9/j

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\959c2d37a1e94337957c5323aab9bf19.exe
    "C:\Users\Admin\AppData\Local\Temp\959c2d37a1e94337957c5323aab9bf19.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dwd49cbz.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7186.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc97C05A14AEF8471880E4F4422AC99723.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3196
    • C:\Users\Admin\AppData\Local\Temp\tmp70BB.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp70BB.tmp.exe" C:\Users\Admin\AppData\Local\Temp\959c2d37a1e94337957c5323aab9bf19.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES7186.tmp

    Filesize

    1KB

    MD5

    92b64022a7c9e7d855fe9b7f5ac85634

    SHA1

    dfb477b0e328668ffe4d25b6ffa9771e4f098cb5

    SHA256

    c0381433eb464e2d763a69fd3ae5a7208be0f77c62f51bbca61e95ec2051e231

    SHA512

    f3828b204dd152098ff8fc711060ad957b51d6351597836bfe37cab718d460ecf1bc3aae3b7c503456d0748466dc32fe456196806e231b9088377b9fc45d0dcc

  • C:\Users\Admin\AppData\Local\Temp\dwd49cbz.0.vb

    Filesize

    15KB

    MD5

    25a34ce585d8b6fcfb26d4f2bbad7502

    SHA1

    4c959d0c8ea742a1bce6a75c3279b54eb4dc6508

    SHA256

    2805c61e1a8108ac9e058bad4bc66a4eff56a53665f3f1054aeb0bcd46af7f99

    SHA512

    a2553a48fdcde7ae232bcf0402f0abc46ee4ec68f76f1f81f3566638c310addb4e13ea6f2ee3be4c9b8aa4aeeb8d1456ffd2909c3ec5415796050c16734a6aba

  • C:\Users\Admin\AppData\Local\Temp\dwd49cbz.cmdline

    Filesize

    266B

    MD5

    20ac619ce2afc6034ad6e0fdf0cfed83

    SHA1

    5c4b5967ae7313e9c8a54ab75aabd1f5ba400d03

    SHA256

    75148c24afcfefe4a5d12ab9034152e1e487927f81d81919e085841275cb658f

    SHA512

    8ad7ab437dd58114d0fbde62423f6f5b0843a4db19e97d4cabf209d2f8dcdd86fb86c346750a1a27234c6c3547d191b9739e00e22a204e7fe47937a979069993

  • C:\Users\Admin\AppData\Local\Temp\tmp70BB.tmp.exe

    Filesize

    78KB

    MD5

    6d4671ea93ab0bad32d1b763d72d43c0

    SHA1

    9f09719626799ebfdb381f5bfe1850574153f781

    SHA256

    2b09e5208b81b9b5dee68dd201b4a6c72902a3e84d81853960c918ad91e58eb2

    SHA512

    aefa5fd13f82ed022a50782d61b1de3b9e0a209b580bb9071faa58df82d981a2fd1112a4016bb2e9a2cb8dcf884c46b60fa89bb6bc7da1cb8db8ed21eab3915f

  • C:\Users\Admin\AppData\Local\Temp\vbc97C05A14AEF8471880E4F4422AC99723.TMP

    Filesize

    660B

    MD5

    f7d7313c295ab95a4810947447ee5126

    SHA1

    effe9116b5136d2d9535e2e1b4beabf4872b7cd1

    SHA256

    2c5c428114d2e61dde9f2419b052baecdc6fe70c98e739037063f3e29457a189

    SHA512

    48ef262ef1bd740fe3d6b859b6955ea03efd8dfaf67a901878952cab1fe098ea54ca71ed6eff82d370b37d927a929487f1f7e50cb4925ccfc1ed74888c3a8ad9

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    aa4bdac8c4e0538ec2bb4b7574c94192

    SHA1

    ef76d834232b67b27ebd75708922adea97aeacce

    SHA256

    d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

    SHA512

    0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

  • memory/1852-2-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB

  • memory/1852-1-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB

  • memory/1852-0-0x0000000074BB2000-0x0000000074BB3000-memory.dmp

    Filesize

    4KB

  • memory/1852-23-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB

  • memory/3620-9-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB

  • memory/3620-18-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB

  • memory/5604-22-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB

  • memory/5604-24-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB

  • memory/5604-26-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB

  • memory/5604-27-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB

  • memory/5604-28-0x0000000074BB0000-0x0000000075161000-memory.dmp

    Filesize

    5.7MB