metamorpherrat | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
888s
max time network
898s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6e297800457d823c0597e833d555135.exe
Size

78KB
MD5

f6e297800457d823c0597e833d555135
SHA1

bef99c4a2e1ad4c2c478f156089158cbc624f7d2
SHA256

da2a754ce56ec13af9f429d5dcd20ff88aadc429a1b0a74d68f217f87e31b42f
SHA512

69ae7dc2898887531ef8faa9740d56e6e40af3d0bafca4f2c78e4e4a37a643afa731985d9fbb9792ea61fd61927d043356a418be09b5ad1b48c73aec81af1790
SSDEEP

1536:7V5jSYLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6H9/0V1aj:7V5jS+E2EwR4uY41HyvYg9/0g

Score

10^/10

metamorpherrat discovery persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	f6e297800457d823c0597e833d555135.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	sortkey.exe

Executes dropped EXE 3 IoCs

pid	Process
4384	tmp5E9B.tmp.exe
2224	sortkey.exe
4104	tmp73C8.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mscorsvc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sortkey.exe\""	tmp5E9B.tmp.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zCom.resources	sortkey.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp5E9B.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp73C8.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6e297800457d823c0597e833d555135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sortkey.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5888	f6e297800457d823c0597e833d555135.exe
Token: SeDebugPrivilege	4384	tmp5E9B.tmp.exe
Token: SeDebugPrivilege	2224	sortkey.exe
Token: SeDebugPrivilege	4104	tmp73C8.tmp.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 2484	5888	f6e297800457d823c0597e833d555135.exe	87
PID 5888 wrote to memory of 2484	5888	f6e297800457d823c0597e833d555135.exe	87
PID 5888 wrote to memory of 2484	5888	f6e297800457d823c0597e833d555135.exe	87
PID 2484 wrote to memory of 2932	2484	vbc.exe	89
PID 2484 wrote to memory of 2932	2484	vbc.exe	89
PID 2484 wrote to memory of 2932	2484	vbc.exe	89
PID 5888 wrote to memory of 4384	5888	f6e297800457d823c0597e833d555135.exe	90
PID 5888 wrote to memory of 4384	5888	f6e297800457d823c0597e833d555135.exe	90
PID 5888 wrote to memory of 4384	5888	f6e297800457d823c0597e833d555135.exe	90
PID 428 wrote to memory of 2224	428	cmd.exe	97
PID 428 wrote to memory of 2224	428	cmd.exe	97
PID 428 wrote to memory of 2224	428	cmd.exe	97
PID 2224 wrote to memory of 1864	2224	sortkey.exe	98
PID 2224 wrote to memory of 1864	2224	sortkey.exe	98
PID 2224 wrote to memory of 1864	2224	sortkey.exe	98
PID 1864 wrote to memory of 2132	1864	vbc.exe	100
PID 1864 wrote to memory of 2132	1864	vbc.exe	100
PID 1864 wrote to memory of 2132	1864	vbc.exe	100
PID 2224 wrote to memory of 4104	2224	sortkey.exe	101
PID 2224 wrote to memory of 4104	2224	sortkey.exe	101
PID 2224 wrote to memory of 4104	2224	sortkey.exe	101

C:\Users\Admin\AppData\Local\Temp\f6e297800457d823c0597e833d555135.exe
"C:\Users\Admin\AppData\Local\Temp\f6e297800457d823c0597e833d555135.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uox592l-.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F85.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2FD8327BD7004785B68B702BAADC73D9.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932
- C:\Users\Admin\AppData\Local\Temp\tmp5E9B.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp5E9B.tmp.exe" C:\Users\Admin\AppData\Local\Temp\f6e297800457d823c0597e833d555135.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sortkey.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Users\Admin\AppData\Local\Temp\sortkey.exe
  C:\Users\Admin\AppData\Local\Temp\sortkey.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7eqcg8dv.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7445.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc923040FE48E3430A885546754D97AE40.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2132
- - C:\Users\Admin\AppData\Local\Temp\tmp73C8.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp73C8.tmp.exe" C:\Users\Admin\AppData\Local\Temp\sortkey.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7eqcg8dv.0.vb

Filesize
15KB

MD5
e12d1ae9de0fb9b713be8697b2f21c62

SHA1
79e64522bbeeb87e39fb416dec810202f81e8262

SHA256
8bc2b846daa4604b0379eec6feea0567703bd378db9f1cd790d47c2982f40556

SHA512
fff2cb407588599e3528646512d4335f995cb13f9990317ad4d893b672e3b2818289f1676551a4c65b8ca8d0e3f9372f46b2d5fc699b3356e080cc0b3c97612b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7eqcg8dv.cmdline

Filesize
266B

MD5
bb110190aa0865dedb2eb4213dc6254e

SHA1
956b63843f91b60fea161651bf7572101011f21d

SHA256
1ee82220732ea1171ab9b7c54b753e1b58412c531bb7ba53fbff4c25291eaf10

SHA512
9fe9089a91a0c4003b68d944e772e9e37a06433d61986025b064d03a71d17ceb6fbc5e68afbc89f081891d21d3059f1fb09ef5b6ccfb6c129b1a01beb1babd81

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5F85.tmp

Filesize
1KB

MD5
b6bfbecf758f63bda2baded1a5afbbeb

SHA1
55a51f9872d2efd4651fcb787a4d9f84f503ee50

SHA256
2010c7bb3b7452b1bb5b211b736b17c92aa279b54728c1384cb4559a3236c281

SHA512
64125d575e281896bb6e7672ff52540ad3ec6a0e2fe7cb8886326b79fd2a812ab460d58f96f6ed96ad7f569e76e02c985fd479c737033de90b44eb9ab24f6e5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7445.tmp

Filesize
1KB

MD5
dc25c0558f3a5a9fe7694060974d7e26

SHA1
0c9c2ae2b4deae4454800563ee506acc550ad92d

SHA256
0645b31f056717b9622e66c6c02c23e23a72eef001ae5dc3d240ba988612afaf

SHA512
b0e81f7be583c1f73b39055ee0437356e9870ca8b1b1bd55aff2457fddc0167faab74cc3e4b95e661067cbaa209d6d8078f10710536a7d6026ea80ae5dfe6ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5E9B.tmp.exe

Filesize
78KB

MD5
d7a4c4a4604881e93756111ecd0ff042

SHA1
8ae6927407afedb2e061b935b33454a414822e9f

SHA256
bfbf84776a5bc186a6866a766dd8d4692f6dddde26834ee3e38a9bdc9e0ae115

SHA512
e5cd3c24704b73c6b4f58d888b4fe859997cebaf52f49b3c72c32f8eb94db5502b562efee114cc2386c94be434a3d54c870e99519eb05fb68eea3e1a2f47a00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp73C8.tmp.exe

Filesize
78KB

MD5
3b9906583d3e57bc1b2d5f80bc944b5c

SHA1
0b403f369f7a073bc3ba218692a95e8e8a5576b9

SHA256
7fcf0560ee9bec2634b70825a8a2ab190c9339f19d743dccc84ee70d92c1a0d4

SHA512
0ab557559bcdfd1f6ed72fe73c18099a61e57a70b3ed20658a498a03d6180101c1f12c68b20fa3d5285d250b48d4f1ec031185997ccc09f3702e4313043af967

Download Submit
C:\Users\Admin\AppData\Local\Temp\uox592l-.0.vb

Filesize
14KB

MD5
4d36c4d61520f031bffc0a9454bd49d2

SHA1
b95646c26fc1e8e6b3f1d23ea4b3347391a5d41f

SHA256
573616e483467c8654eebe49de3bb9ab44fcaffcc23707ce73598dc66e0e4807

SHA512
84ffde40ebc968337d0b6e47a2cf4ded99ceed9a4895b2e6692fc967f61d4320a4367ddb5a8f3bbe6c4c2e1ce29d601789fdf06eddd296c2da2ee6f29da8d8e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\uox592l-.cmdline

Filesize
266B

MD5
bc9294d2530a6aefde262f6a32bcb2e5

SHA1
8a525377773e7add3698a1952df43aea70eb85d8

SHA256
f7789e88af6b87de81b55a65734879bd5155882ccd1c7c4ba226cb32699a2fcb

SHA512
7694b72c8744230501fc186e60b29fd91edcb0a055a7eebe28d341b75165c4bbf19564725b2e5137ca5ae912efe7587e136f89be915145542fe885e1dc9f5174

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc2FD8327BD7004785B68B702BAADC73D9.TMP

Filesize
660B

MD5
ecf5a485ae5f8deaa3a2ffe9a7b68159

SHA1
95b6ef68938cd64aca2d9005abe31a28aca4b603

SHA256
7ea4265c3f62c123223bc0efe5079108d9a71d96f752bcbf1cec446180df56b6

SHA512
1e44c2b60341281d8a7c408d804eccb2184b33df69973ce4ab1fe18b3eb8f4eaf2123d52cc7ec40bf67f0f81e7c951ed1cf7d9783fdac38d8a39aeefd53868dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc923040FE48E3430A885546754D97AE40.TMP

Filesize
660B

MD5
f150e197a9cf7ea89c755a9f96e405f7

SHA1
cd941346c3c65996764c41b651d541b11a7ca556

SHA256
740aa4fd03d773fac67cd00e8782e2877edc2b64060d738aa6fb77c50c9a3cf1

SHA512
11900e366f8f78068e0a632093125fc0350a4f0fc86559d8c22ace9ea9bc17cd44f2658671af573dd978c2ac9c3fbac8af43d9d1e737ecfe7634f1735a04e355

Download Submit
C:\Users\Admin\AppData\Local\Temp\zCom.resources

Filesize
62KB

MD5
6870a276e0bed6dd5394d178156ebad0

SHA1
9b6005e5771bb4afb93a8862b54fe77dc4d203ee

SHA256
69db906941dec2a7f1748ea1d15a058751c77d851ce54ea9e2ebdf1d6c7ed4f4

SHA512
3b6f412d4bdf0939677ab6890a6417da6f737376e13375d2a60871de195aa14344b8340d254b819c850d75a443629cbf26f35533e07aaba9532fdc5284132809

Download Submit
memory/2484-18-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/2484-8-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/4384-23-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/4384-25-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/4384-24-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/4384-47-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/5888-22-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/5888-2-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download
memory/5888-0-0x0000000074C52000-0x0000000074C53000-memory.dmp

Filesize
4KB

Download
memory/5888-1-0x0000000074C50000-0x0000000075201000-memory.dmp

Filesize
5.7MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads