Analysis

  • max time kernel
    139s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:14

General

  • Target

    96959cb1423fd801a2e3d718868a3776.exe

  • Size

    78KB

  • MD5

    96959cb1423fd801a2e3d718868a3776

  • SHA1

    65d1736c9b979158bbfd4c1674f91fb034506eef

  • SHA256

    1905c3deaf30debadbb9311cd746db562d2c92f17ff356b6a66d9e448fc7ce6e

  • SHA512

    1ff6b163e10a01f18d28d5be955665324e63606ed380b15ca66943b1547f366f7713b291ceb48a42b02d7912b1f3ee3a1077f0d0ebec28eedd0579627609df28

  • SSDEEP

    1536:vsHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtD9/213n:vsHY53Ln7N041QqhgD9/Y

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96959cb1423fd801a2e3d718868a3776.exe
    "C:\Users\Admin\AppData\Local\Temp\96959cb1423fd801a2e3d718868a3776.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6008
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\elyc70bi.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9357.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5ECE8E4D2034D03A09B67E2A8BC28B4.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5132
    • C:\Users\Admin\AppData\Local\Temp\tmp926C.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp926C.tmp.exe" C:\Users\Admin\AppData\Local\Temp\96959cb1423fd801a2e3d718868a3776.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES9357.tmp

    Filesize

    1KB

    MD5

    f47d7bbb40f98fda16bdeb6f5454e31f

    SHA1

    e46e50cfedd47263d52ca45be504c432348e5555

    SHA256

    69f531e3bb727c2ed176b14a7b20f6053116db8202eb08d7f311281b01fa2982

    SHA512

    e5987e90fb0935d5ec839e59578aef8ad4be957522e9b15438b40e53a70974011376d5f0e9ffd8143c98858cdda86aec4c4273eca0fa18186bdf61477cebe2cc

  • C:\Users\Admin\AppData\Local\Temp\elyc70bi.0.vb

    Filesize

    15KB

    MD5

    3389331d2b13d936527a3e98c126566b

    SHA1

    f7e83486df23caaf11d60620fc0616bd0e8583d0

    SHA256

    3e0fb46e5e188bede630a92ccfd9e02391f4e57c803154edefff5ee9866fc1dc

    SHA512

    fd0e398aa61e24920c678f721a08055e56c54179d89ca7ff9afc82880a94bd18fcf293ff71ffbb109c83d9ef1171fedf478f095b388c358893390045089dcd8b

  • C:\Users\Admin\AppData\Local\Temp\elyc70bi.cmdline

    Filesize

    266B

    MD5

    af414a4c79b9856e96e078ba27bdfc2a

    SHA1

    e849227a8e9b1e8d65537630bb84b8f4b7627c2b

    SHA256

    1d1085a114d012e759b90d83d2a3db955fa777026af35fb0aa31cf8fcf7f9ff9

    SHA512

    3a37559230406e0f03eee1776db0ae4e02af61d5f4eca3c5efdc8b4454f294bd2d34bbba502355ed3176fd94afd6bca8b13f543ec856b338be9964f9b8f447d9

  • C:\Users\Admin\AppData\Local\Temp\tmp926C.tmp.exe

    Filesize

    78KB

    MD5

    b21fe70c7b4f34c70ac196e0fadbec74

    SHA1

    a6d07bcb1d0f8567a2c2b6a630b616b7e9cd47ba

    SHA256

    911aad8db36a10739461b1922b4c49996797c4b3b3c5c698d345795380577a88

    SHA512

    ce81676e9691b6579ecffc43455767f4769e237e663b40971ff430a99bb45ca06711d77a954549ac1c28e279ba0f13b794c15d381352c141f243be032134cb44

  • C:\Users\Admin\AppData\Local\Temp\vbc5ECE8E4D2034D03A09B67E2A8BC28B4.TMP

    Filesize

    660B

    MD5

    d0aeae7d0905adf07d57d68290108405

    SHA1

    54813bc885c050dfc0e54f57754eeb7ce1f33c12

    SHA256

    32d2d82c80bf4e940a6bcc793e4ecdcae1702fafe6e0d57657fe18e1c7135005

    SHA512

    dc4eabf357162ddb825199c2e0ef3ea7f75ba115319bcc35cbbd819693be79867e676c9385ccf6e8dcbe5d937970d2fb1792f682f658e84425cdb7f2478585fd

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    aa4bdac8c4e0538ec2bb4b7574c94192

    SHA1

    ef76d834232b67b27ebd75708922adea97aeacce

    SHA256

    d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

    SHA512

    0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

  • memory/3128-23-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3128-28-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3128-27-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3128-26-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3128-24-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3556-18-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB

  • memory/3556-8-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB

  • memory/6008-22-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB

  • memory/6008-0-0x0000000074A42000-0x0000000074A43000-memory.dmp

    Filesize

    4KB

  • memory/6008-2-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB

  • memory/6008-1-0x0000000074A40000-0x0000000074FF1000-memory.dmp

    Filesize

    5.7MB