metamorpherrat | 0468fb7572fa9f843aad2aa21c3278595fcca3bc044bb6901af08cc8c8db8dd0

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20251223-en
resource tags

arch:x64arch:x86image:win11-20251223-enlocale:en-usos:windows11-21h2-x64system
submitted
18/12/2025, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_3a555e944b1cc48510314cb219757b58.exe
Size 78KB
Sample251218-2anlfsev7f
SHA256 0468fb7572fa9f843aad2aa21c3278595fcca3bc044bb6901af08cc8c8db8dd0
MD5 3a555e944b1cc48510314cb219757b58
SHA1 dfde6f7989a47aece53047cf5dc79cc7aa0ff3a8
SHA512 017a9d49abbb3d36639124d7ecd07cab440376ba92babfee47db57b89b30ec50fbe11237ad4205b251e14b3736f04074ad19397a0de4ed8e0cde6b4ac9637c43
SSDEEP 1536:QcsHY6uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtQ9/a1Oy:7sHYI3ZAtWDDILJLovbicqOq3o+nQ9/i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Executes dropped EXE 3 IoCs

pid	Process
1156	tmp92BA.tmp.exe
4624	InstallMembership.exe
32	tmpAD38.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2287063978-2792114460-3831676462-1000\Software\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmp92BA.tmp.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zCom.resources	InstallMembership.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpAD38.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_3a555e944b1cc48510314cb219757b58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp92BA.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallMembership.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	JaffaCakes118_3a555e944b1cc48510314cb219757b58.exe
Token: SeDebugPrivilege	1156	tmp92BA.tmp.exe
Token: SeDebugPrivilege	4624	InstallMembership.exe
Token: SeDebugPrivilege	32	tmpAD38.tmp.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4560	2476	JaffaCakes118_3a555e944b1cc48510314cb219757b58.exe	79
PID 4560 wrote to memory of 416	4560	vbc.exe	81
PID 2476 wrote to memory of 1156	2476	JaffaCakes118_3a555e944b1cc48510314cb219757b58.exe	82
PID 4624 wrote to memory of 3284	4624	InstallMembership.exe	85
PID 3284 wrote to memory of 5900	3284	vbc.exe	87
PID 4624 wrote to memory of 32	4624	InstallMembership.exe	88

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a555e944b1cc48510314cb219757b58.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a555e944b1cc48510314cb219757b58.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6ksauidv.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9376.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D8E713DC165419DB9380E694B323CB.TMP"
    3⤵
    PID:416
- C:\Users\Admin\AppData\Local\Temp\tmp92BA.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp92BA.tmp.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a555e944b1cc48510314cb219757b58.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1156

C:\Users\Admin\AppData\Local\Temp\InstallMembership.exe
"C:\Users\Admin\AppData\Local\Temp\InstallMembership.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lnni2l4n.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADC4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD278F546826C4BA3A1DD89DE6158BF42.TMP"
    3⤵
    PID:5900
- C:\Users\Admin\AppData\Local\Temp\tmpAD38.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpAD38.tmp.exe" C:\Users\Admin\AppData\Local\Temp\InstallMembership.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:32

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6ksauidv.0.vb

Path C:\Users\Admin\AppData\Local\Temp\6ksauidv.0.vb
Size 15KB
SHA256 bc06aadd0df34c59493d49feb2d443492e0b1b6916d25342e06d4e6f8edf1769
MD5 8e92f20793773245ba89186026232a24
SHA1 bfa98f3e68bead0a48f7376a07fd6ece7c53b926
SHA512 5f22b970fa103bb06fa4141e6405989f082c8abfb6a309667e75faefae15c4c29ae914f98242f1cbaa08131225a22f25c798a97579ecace25181e90cb83d7c24
SSDEEP 384:rLLN6gNJUTZNxNjCeAN9NtcHbWE6NFzN7QLSN7eP:hD0zLKvtcHeFhC+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

6ksauidv.cmdline

Path C:\Users\Admin\AppData\Local\Temp\6ksauidv.cmdline
Size 266B
SHA256 842882da6db31fce717a59b20ef4fcdb8686929e5e359b926fd9adb9581ff504
MD5 03f92b70fc2f0e361c05bcf549d06dad
SHA1 b6c5ff32a857765525f09eb03f1baefa1d24e15c
SHA512 27b44383fa7e29a6298aeb0b693c6c657158e8703946a382f1c95e93f634842e55b151d2651bc7cfe2518df0a67a52a5ac04c455b9a1ac47bd5bc9559a4cc39c
MD5 SHA1 SHA512

Submit Download

RES9376.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9376.tmp
Size 1KB
SHA256 4d68f2ab09a5ac0e7158e6f2be9a2b756dbfa3b0d1a95c4ea2101a076f65478f
MD5 9030f514730f754f46a0afb8987cd51d
SHA1 0f3a61247db808f23f55421ed6db1b6a18245227
SHA512 4b741130c530bb46b44bc6f3f85a11ac95e2cc2efb7892c2caf831eb9db4d979187560f846a78f0534f02e0df81c351fbd271a1e3cae9d5e1def921532b0a5ae
MD5 SHA1 SHA512

Submit Download

RESADC4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESADC4.tmp
Size 1KB
SHA256 896c528bcc2660c71af9b44ff8d4a8314160040a319633e96572af77273f44af
MD5 ea81383b559fd253dc75cc7b9f88a9e1
SHA1 c8d37bd0ab8fd3058a3cab3d7a34831e99e12b9c
SHA512 6158cd978df49d0a4a2f4117a81e8d18871dabe017f697d31decbc0b28ef8bda3bf011371944483cd4781ee5da65b823c13c79e44732729361cb7bcb18269b76
MD5 SHA1 SHA512

Submit Download

lnni2l4n.0.vb

Path C:\Users\Admin\AppData\Local\Temp\lnni2l4n.0.vb
Size 14KB
SHA256 c6579c898a0e1508ef5efeabf88fe913bbf9d13c02d3d20fb669257b62becfcd
MD5 ce80ae1cf5cfec1a31d93f4f477ee435
SHA1 5b8b650fb6f7d665fb39340928ffda5d30a5ada5
SHA512 e015bcb5bb4e30dc15a8e95295f6b1028b963a7c31347137bec2a4e87da757b5efafb499fc75f840029adc2f3ea48e83cbbf48091a3de36f796856a3281848de
SSDEEP 384:rMLNONqNBqNdOWNENCcHbufE6NyzN7QvSN7eP:Yi2ANkCcHC7yhw+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

lnni2l4n.cmdline

Path C:\Users\Admin\AppData\Local\Temp\lnni2l4n.cmdline
Size 266B
SHA256 0dd459804958f76079f3c9dddbe4b6f913e163b8f7a7480aec9bcc7dea2aa400
MD5 f90840f4bc7dfddef11caae8fb978495
SHA1 791c8ebbf802cc4ff22b7fc93aac037a69c1989c
SHA512 29d01dbd497c3cda404a60cbf49a076636de716da5c1820e208230b194c7524766083c66b6cc4496a00ca957941c6dcb7f4aa5c012fdcd0424709deb429623b8
MD5 SHA1 SHA512

Submit Download

tmp92BA.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp92BA.tmp.exe
Size 78KB
SHA256 edcadfcc9e2e8728a1ebd8c0084e5c511bf449eca9fc252f197bbcd107fe5cb3
MD5 1a366b2e7d1a570f6b0f59537e846b46
SHA1 24c6f29ac27faca15fd97465a1d5c16b16fe7065
SHA512 f69e590d7fb52acdb72dc7382e7d94bb18677a1774ec79564f0e78ea1882c30320ed00e64b87c26c35abf42dc0f979a95bd7c9871b6e993bb98697fbbcf043d0
SSDEEP 1536:8XRWV58WAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6B9/N1DH:8RWV58WAtWDDILJLovbicqOq3o+np9/7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpAD38.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpAD38.tmp.exe
Size 78KB
SHA256 50631d51d713aa1c406e4c2680088bf98af927df1f95d600e7981814daa4a908
MD5 6919af8eb0a7db00c009d09cce14a30e
SHA1 c268f3ed78c27475743eda22163a76834d8f0d06
SHA512 364eac47b3d3feb12b0e36a536314be51a4ecfe3d7dfda0e5af40d3882e42728c37371e3ca9daacf2194f3278590e104a87561c87f2de82bb2374c9e3e625130
SSDEEP 1536:/csHY6uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qtm9/E1YI:EsHYI3ZAtWDDILJLovbicqOq3o+nm9/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc3D8E713DC165419DB9380E694B323CB.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3D8E713DC165419DB9380E694B323CB.TMP
Size 660B
SHA256 194bef0050a09e8e483453e1a9aa4b7d7b04821cf59d5245e910796c5fdbd64a
MD5 297aee3ab6e57604fe296827aa445e6f
SHA1 4f722ff4777854d17fc3e93e3549a96b27b76a9a
SHA512 5ed589768d7f0a74015aaeb515ca40c45481909b857391b2135f26dc638ff4e454f9b8f6082a684eceedac81b4facc4e61a38590d756423a86b7740564e4a1a5
MD5 SHA1 SHA512

Submit Download

vbcD278F546826C4BA3A1DD89DE6158BF42.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD278F546826C4BA3A1DD89DE6158BF42.TMP
Size 660B
SHA256 8d260cd83ec4b65b0f81804b2a713900b643a3f05bd4bf3017c8ab47b5cfcfe1
MD5 c3474e2b9d53470a25ddaa4aac2c437b
SHA1 ce3e7c0e40fe999c44c11797ce9015b2f5ab8c6f
SHA512 3363e50559d3ccd73ac6a7649a218beaaaeb7f10b1ac8100d0eb9d85be446b068e6471cf6073794ace3b4a936a0f052df60cb98e3a70b66f45f755442d10138f
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5
MD5 a26b0f78faa3881bb6307a944b096e91
SHA1 42b01830723bf07d14f3086fa83c4f74f5649368
SHA512 a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c
SSDEEP 1536:sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtQ:sAtWDDILJLovbicqOq3o+nQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1156-22-0x0000000074560000-0x0000000074B11000-memory.dmp

Download

memory/1156-21-0x0000000074560000-0x0000000074B11000-memory.dmp

Download

memory/1156-40-0x0000000074560000-0x0000000074B11000-memory.dmp

Download

memory/2476-20-0x0000000074560000-0x0000000074B11000-memory.dmp

Download

memory/2476-0-0x0000000074561000-0x0000000074562000-memory.dmp

Download

memory/2476-1-0x0000000074560000-0x0000000074B11000-memory.dmp

Download

memory/4560-8-0x0000000074560000-0x0000000074B11000-memory.dmp

Download

memory/4560-17-0x0000000074560000-0x0000000074B11000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads