metamorpherrat | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

08/04/2025, 14:11

250408-rhjmcsvp15 10

22/03/2025, 06:18

250322-g2ywaay1fy 10

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6e297800457d823c0597e833d555135.exe
Size

78KB
MD5

f6e297800457d823c0597e833d555135
SHA1

bef99c4a2e1ad4c2c478f156089158cbc624f7d2
SHA256

da2a754ce56ec13af9f429d5dcd20ff88aadc429a1b0a74d68f217f87e31b42f
SHA512

69ae7dc2898887531ef8faa9740d56e6e40af3d0bafca4f2c78e4e4a37a643afa731985d9fbb9792ea61fd61927d043356a418be09b5ad1b48c73aec81af1790
SSDEEP

1536:7V5jSYLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6H9/0V1aj:7V5jS+E2EwR4uY41HyvYg9/0g

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	f6e297800457d823c0597e833d555135.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	sortkey.exe

Deletes itself 1 IoCs

pid	Process
3868	tmp83C6.tmp.exe

Executes dropped EXE 3 IoCs

pid	Process
3868	tmp83C6.tmp.exe
2316	sortkey.exe
4148	tmp99DE.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp83C6.tmp.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zCom.resources	sortkey.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sortkey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp99DE.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6e297800457d823c0597e833d555135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp83C6.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	f6e297800457d823c0597e833d555135.exe
Token: SeDebugPrivilege	3868	tmp83C6.tmp.exe
Token: SeDebugPrivilege	2316	sortkey.exe
Token: SeDebugPrivilege	4148	tmp99DE.tmp.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 636	4296	f6e297800457d823c0597e833d555135.exe	88
PID 4296 wrote to memory of 636	4296	f6e297800457d823c0597e833d555135.exe	88
PID 4296 wrote to memory of 636	4296	f6e297800457d823c0597e833d555135.exe	88
PID 636 wrote to memory of 2492	636	vbc.exe	90
PID 636 wrote to memory of 2492	636	vbc.exe	90
PID 636 wrote to memory of 2492	636	vbc.exe	90
PID 4296 wrote to memory of 3868	4296	f6e297800457d823c0597e833d555135.exe	91
PID 4296 wrote to memory of 3868	4296	f6e297800457d823c0597e833d555135.exe	91
PID 4296 wrote to memory of 3868	4296	f6e297800457d823c0597e833d555135.exe	91
PID 1152 wrote to memory of 2316	1152	cmd.exe	98
PID 1152 wrote to memory of 2316	1152	cmd.exe	98
PID 1152 wrote to memory of 2316	1152	cmd.exe	98
PID 2316 wrote to memory of 5064	2316	sortkey.exe	99
PID 2316 wrote to memory of 5064	2316	sortkey.exe	99
PID 2316 wrote to memory of 5064	2316	sortkey.exe	99
PID 5064 wrote to memory of 2544	5064	vbc.exe	101
PID 5064 wrote to memory of 2544	5064	vbc.exe	101
PID 5064 wrote to memory of 2544	5064	vbc.exe	101
PID 2316 wrote to memory of 4148	2316	sortkey.exe	102
PID 2316 wrote to memory of 4148	2316	sortkey.exe	102
PID 2316 wrote to memory of 4148	2316	sortkey.exe	102

C:\Users\Admin\AppData\Local\Temp\f6e297800457d823c0597e833d555135.exe
"C:\Users\Admin\AppData\Local\Temp\f6e297800457d823c0597e833d555135.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gbcpusom.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES851E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc756A871E225E42EF82813CC7173139A8.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
- C:\Users\Admin\AppData\Local\Temp\tmp83C6.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp83C6.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f6e297800457d823c0597e833d555135.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sortkey.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\sortkey.exe
  C:\Users\Admin\AppData\Local\Temp\sortkey.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pjv0icul.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A3C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF25EC569810C4F7784B4E02B4072.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2544
- - C:\Users\Admin\AppData\Local\Temp\tmp99DE.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp99DE.tmp.exe" C:\Users\Admin\AppData\Local\Temp\sortkey.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES851E.tmp

Filesize
1KB

MD5
97a7cd05ac56fad981d7361388fdb63b

SHA1
503c534046151b2ea8a35a2d1b7038995a7d6f6a

SHA256
cb72dcaa0732ecedbd166d3a76cb9b28fe25ab1dd6cf0c8d958a1480d67bc151

SHA512
69e8eace26f135b3b5534b9c3085a8d97aa013edf2b7980432564a8e19de925621299db7fe3e037dc829f5b832106e9a0d63ba8ce097df0cf4e1671163d00681

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9A3C.tmp

Filesize
1KB

MD5
2ea2c3d015e8499caf0fb25c0dccf415

SHA1
7ba651ca3f6939913e2e5cf89104e136055a0790

SHA256
1c116adfdcc949e545d73a298ff115c79c9862b93e6cc470ed5d13aa48b4a626

SHA512
491bd3202d34b745d2c9e85a9556a3ec0bbe07ab086cdeb4033655bdce8dd291401e74ebf4c21df72ea33477399265d1c1b2a8422ff2a953cbcb42744c1a0996

Download Submit
C:\Users\Admin\AppData\Local\Temp\gbcpusom.0.vb

Filesize
14KB

MD5
9a47e9b3f021b893a0f72f479243a81c

SHA1
192d5d00f0c6150dda56bb8afaf06ebdcc788e52

SHA256
b32ac657f7d2797155aa468a1d17cdc8aac2f62ad54d78e24feff40b2f340a06

SHA512
2bfd9fada02b4aa1a71297bfb081687092ca9f342f95e76f630aee2fb91980088813bd965dd229deb84f3a60af10825419a83fc5b9e5faa3fdac399e1602acdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\gbcpusom.cmdline

Filesize
266B

MD5
96b0415ef62f0d8f83dab64a9441f169

SHA1
d8efa517207773f7dedcbbd81509f748ba77f612

SHA256
0060d68a8d8094e33761f3e30bbe64e818b993033c30ce1b3a4dc03b02476663

SHA512
2327363d091b769eb05497b8e2829f50801c522cade5813f419050e828117ccdced0e6184a399cbad57797b2f2a1fb41b9cb96e52f1a5ffc46f549b0726ff0c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pjv0icul.0.vb

Filesize
15KB

MD5
35f415f3c05754b9907c9d0022e25d1b

SHA1
9c3c6bbc3ff9f1fb43947c987f6d6738c06c65c9

SHA256
90a6395579fb8b6ef8d5b9151a244cb5c5118d5407b9374f81e9c4f91f9db8c4

SHA512
42050171973a49b851d1e16ea4033b971fa0d21b33e5e93f3a0bf7984264b34511ae1e821707310b095caf11ea97163360fa214ea255f3b37b4f5952620bc87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pjv0icul.cmdline

Filesize
266B

MD5
92386bfe9e99f6e42b90ba0f7e7022cd

SHA1
f0efff75b3e9967c7735dfa0e2c9cb05e31aad4e

SHA256
62983a18d487ca3d8ffca8c1807bb9416f20a5fd99aa62bfa4f4c7980e9c9561

SHA512
f7e10fb930d10ddb0a17e903a7688aa8ce75c6644c3f5f9b3f6d1b9a1af26219f6973b097e651f1017838cc1babbf224b93a3f50f5ad3b3ff3d7d629bb79fb3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp83C6.tmp.exe

Filesize
78KB

MD5
abebece7d22ffd8c6a8885430b5f6371

SHA1
e4459495ade81739f073b60467b02434e21e98f9

SHA256
66d42c65d944fc1d3f449fb56c5f79565a7779fad382220feef7876fdac85e7f

SHA512
a989dd43e23dc6b62927e14865ef2806672e84152b7827c0a2c4827fd1f6db28384748d1962c58b90bed00711cd71ab5d1130f8002a7cba3be7c5ccf365db14a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp99DE.tmp.exe

Filesize
78KB

MD5
71dbf1534d3e0f057ae34712792f2703

SHA1
a91215d6c881b2ebeb1f07a14e10dbe0a5c66b27

SHA256
520cee1f9e6558e1d2813defd87f87948dd4b1bd88ddd17c32e5e9222c79732d

SHA512
1dd876a8650c523d03eae3b600a71e89be3f4048ad0cf6cff795b245284367e85a158d5739824277646405e0acb2bc720c5534730712bd8bf6c5101c16186dd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc756A871E225E42EF82813CC7173139A8.TMP

Filesize
660B

MD5
141f59bff19a2bae5aa9b9888aeac390

SHA1
ce6826c65bbf9b74987285ebe395fb33ed308384

SHA256
5dd75949b9ed5de57fe3f062485125b5df09dede09fdd4a3e64c77603c1f2d9e

SHA512
d94552c41cb8d44c0643b9ffc4869210a93f3b4df5a845caf11f8ae22392a2fecebb18cbafb9606a2709711183c2f1c9df97a735a9424c608fcc56ece45d93f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcF25EC569810C4F7784B4E02B4072.TMP

Filesize
660B

MD5
41ad19e45e2ca74daef307071312e1f3

SHA1
3bcaf1fd19af2fe344c7c8d7b58aba770e528d30

SHA256
91ae2ed0fe98babb0df2a9e504f4b568363fd70c06b96a2358ea9cd2ce059744

SHA512
e622731b1e3b0ad860a818ca9ee38dd12c6aeb8fc6d899f4b58329268499d5dcac617e2c4c9ce4df9399f5c079df19dc87c544cb66d83f5879ecc25d2d7a27db

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
6870a276e0bed6dd5394d178156ebad0

SHA1
9b6005e5771bb4afb93a8862b54fe77dc4d203ee

SHA256
69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

SHA512
3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

Download Submit
memory/636-9-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/636-18-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3868-24-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3868-25-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3868-23-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/3868-47-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/4296-22-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/4296-0-0x0000000074CB2000-0x0000000074CB3000-memory.dmp

Filesize
4KB

Download
memory/4296-2-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download
memory/4296-1-0x0000000074CB0000-0x0000000075261000-memory.dmp

Filesize
5.7MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads