metamorpherrat | ca006f795a178625e3329abb631565e1444422c3a8202663412f949633b8e301

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20251223-en
resource tags

arch:x64arch:x86image:win11-20251223-enlocale:en-usos:windows11-21h2-x64system
submitted
18/12/2025, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_372fecc1b86bd736486de02aa1221f90.exe
Size 78KB
Sample251218-yd2eyagy8e
SHA256 ca006f795a178625e3329abb631565e1444422c3a8202663412f949633b8e301
MD5 372fecc1b86bd736486de02aa1221f90
SHA1 40fdeb43d40cd31a7795f8fa4c77531f020664a6
SHA512 d811ea52bfe6c5f758f3057ef33eb393fab0faa57da899c8969d06aa60839fe26df5bde6d94e5ffe9fa503327d52ab11e6b27455832835f08829f855b67498c6
SSDEEP 1536:FcV5jpAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6A9/s16R:6V5jpAtWDDILJLovbicqOq3o+nI9/r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery metamorpherrat persistence rat stealer trojan

Malware Config

Signatures

MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
trojan rat stealer metamorpherrat
Metamorpherrat family
metamorpherrat

Deletes itself 1 IoCs

pid	Process
1200	tmpA122.tmp.exe

Executes dropped EXE 3 IoCs

pid	Process
1200	tmpA122.tmp.exe
5904	InstallMembership.exe
4904	tmpB798.tmp.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1137014038-3678899601-2033181133-1000\Software\Microsoft\Windows\CurrentVersion\Run\caspol.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\InstallMembership.exe\""	tmpA122.tmp.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zCom.resources	InstallMembership.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallMembership.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpB798.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_372fecc1b86bd736486de02aa1221f90.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpA122.tmp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5564	JaffaCakes118_372fecc1b86bd736486de02aa1221f90.exe
Token: SeDebugPrivilege	1200	tmpA122.tmp.exe
Token: SeDebugPrivilege	5904	InstallMembership.exe
Token: SeDebugPrivilege	4904	tmpB798.tmp.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 3632	5564	JaffaCakes118_372fecc1b86bd736486de02aa1221f90.exe	77
PID 3632 wrote to memory of 3708	3632	vbc.exe	79
PID 5564 wrote to memory of 1200	5564	JaffaCakes118_372fecc1b86bd736486de02aa1221f90.exe	80
PID 5904 wrote to memory of 4976	5904	InstallMembership.exe	83
PID 4976 wrote to memory of 3060	4976	vbc.exe	85
PID 5904 wrote to memory of 4904	5904	InstallMembership.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_372fecc1b86bd736486de02aa1221f90.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_372fecc1b86bd736486de02aa1221f90.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sv-3zz45.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4933967844BA4087807C6ADD704F5A67.TMP"
    3⤵
    PID:3708
- C:\Users\Admin\AppData\Local\Temp\tmpA122.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpA122.tmp.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_372fecc1b86bd736486de02aa1221f90.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1200

C:\Users\Admin\AppData\Local\Temp\InstallMembership.exe
"C:\Users\Admin\AppData\Local\Temp\InstallMembership.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lfz4wy6p.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB805.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDF3179558F0403EB5333D87753CC94F.TMP"
    3⤵
    PID:3060
- C:\Users\Admin\AppData\Local\Temp\tmpB798.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpB798.tmp.exe" C:\Users\Admin\AppData\Local\Temp\InstallMembership.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA1BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA1BE.tmp
Size 1KB
SHA256 174f9e60d8ae78b1d908f01f6353a40af82b5825fdbbd33f7293d48e3f40a32f
MD5 2ee046547af42623b6f7d4f2e429d473
SHA1 86dba2383855b036b58b027af36a83b7a491730d
SHA512 1b4f48ba7930f70738c4543b54899326af59ad7986ad4aa19180b747e4aca4ec0815354392589090eaf3ef05c063b952a8e40c197fd2ee6b9ed8fb6988a944d2
MD5 SHA1 SHA512

Submit Download

RESB805.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB805.tmp
Size 1KB
SHA256 04210befda9986cc90c44ae900d5301b5e9bfd2fc0e764e3e4819c940e309ceb
MD5 7fe6fc2fbb9adab619165b04d18bc5e3
SHA1 b6eaecbfe1b8c35ed2e8bdf5ce8541988d4109d3
SHA512 6da6db53334a959803c0dc34d4fce9ea47cad4c1830b3c77756681c179aafae9243c992a3728848c1b3008d565ec226afe3b5f28565bbd04b47dd9ee30116371
MD5 SHA1 SHA512

Submit Download

lfz4wy6p.0.vb

Path C:\Users\Admin\AppData\Local\Temp\lfz4wy6p.0.vb
Size 15KB
SHA256 a273f7faffb1fa10cf1cc6ebebfb895dec6f510f29c5857475a3f611d708a556
MD5 81d31f42aed8bcf728427883402de275
SHA1 5a96e2827afb2aa2d21a37fffbf687a408a046df
SHA512 116ead0a717eb669f1752ff47248d943c7279d5a6b8ced21f354cfcd450c65ca51b84a7fc95b6af403ccc038ec84b88a71f2ae8a824cb763a53abc29508a78fb
SSDEEP 384:ruNe/lNu5qNgoNp1UfNPNbcHbQE6N9zN7QJSN7eP:Ge/XuAdDO1bcHY9hw+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

lfz4wy6p.cmdline

Path C:\Users\Admin\AppData\Local\Temp\lfz4wy6p.cmdline
Size 266B
SHA256 1a87b6d6e972ecc717e68b289248f9b27c60322f9cdf65e88bf7c306a78d13f1
MD5 0d0ab47bd55c316669cf7f1ff48a51e4
SHA1 6dafee1203135fc3ea44bdefddcaf64c8bf09d1c
SHA512 b29fe51e098afec30227e0c63d9d2a104925d7e37c94c05403c92e7cc2b2fb00595cc5137c3489753a3e232e05dc4ef56a22b8170181428799eec699dbdb1f37
MD5 SHA1 SHA512

Submit Download

sv-3zz45.0.vb

Path C:\Users\Admin\AppData\Local\Temp\sv-3zz45.0.vb
Size 14KB
SHA256 6fa991a5bd64402e6d3fba9aca727430f8a7d79a9da59472b63c276341b9e71d
MD5 1e9c290b78c8b3aae1e10347bb8805f1
SHA1 7c3d88ed671419565d64cc0cf55166bc79fdb807
SHA512 570ed36fc1dc9b0dcf238e25ea2e73e2daf3b0a14b44a58b3c15453aad71115149cec2b8abcd9c9e4e93667be4917d07d70c9ab4b3ef8be5b5a4cb3118dec975
SSDEEP 384:rMBNYN8TN8lNTO7NENtcHbufE6NyzN7QvSN7eP:mg8B8XQktcHC7yhw+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

sv-3zz45.cmdline

Path C:\Users\Admin\AppData\Local\Temp\sv-3zz45.cmdline
Size 266B
SHA256 7e9d08e7611c2cdd55cff1788f808e65846420a8fe8df420c411d184676e661c
MD5 7f0034a4767d35f12d99a737179f5e6e
SHA1 b76b88a9584b02710ab0b50792a41f6d8b10dfdf
SHA512 848a5a305a051f71b90fa572d0f957aa65fd78861a7dfa63e14ab5ddca393ebe6312aa7b1aad60a2cd40b103fe8c726c6ad41a2785ea9f98d7f5d57e5b83c2fa
MD5 SHA1 SHA512

Submit Download

tmpA122.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpA122.tmp.exe
Size 78KB
SHA256 baeded9ff2097d2cfe33f6006a401bb7ce4290807bb117dfc15edd4d7bc727bb
MD5 a53a4b74879c404467f910bd129599c7
SHA1 8fd6dbd4d3a641e70e6f2065d4b91f337f3f2b35
SHA512 62835647f0c6def4a0b32a0a814f8ce41fa4308af40898bcbe37b09fe086d299eba174612af04335bbd646740c1f86c0d055b4a26c7f26502143d80640ef14de
SSDEEP 1536:KcPWtHF3uaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qt09/D3:pPWtHFP3ZAtWDDILJLovbicqOq3o+n0Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpB798.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpB798.tmp.exe
Size 78KB
SHA256 6842e7388960fad85551da55ca3fe6cef8b592abebef887589fea4bcaaf14425
MD5 97c3a5f0ea7e5e238a75aa7cd3c63928
SHA1 44f015b19d668c0b538ad6bfcec539ef5ccad06e
SHA512 125e64022c6d1b62df3b90bb227599c786d09f5234d465bfb29fc35186e5dcee07c8def26218915cbc7ce6987b920264f1ac7d134373f5012c8e310ef53dce73
SSDEEP 1536:oTWV5jSUAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6m9/T1NT:QWV5jSUAtWDDILJLovbicqOq3o+n+9/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc4933967844BA4087807C6ADD704F5A67.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc4933967844BA4087807C6ADD704F5A67.TMP
Size 660B
SHA256 70543030229636a47bf6cedd1426f29e4aaa13465c6b47fbd8fbdf7d11238e6e
MD5 d7d7b06f3e756908570d0864024c7ef9
SHA1 70798d3fcb5a238073ac49ab1b8f080e50fd5e87
SHA512 f756132643982722dee98595a5a6d7f354b66c6b5cba576ca3eb3944532f42a03378e5d1ce75ba6aed0c2452af8fb013764267da595bc2368d915c1f1624055b
MD5 SHA1 SHA512

Submit Download

vbcDF3179558F0403EB5333D87753CC94F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDF3179558F0403EB5333D87753CC94F.TMP
Size 660B
SHA256 9e936c60050a673a6c6703d029b0d8945c3b2f1c923dad8a042ae20bc0e2514a
MD5 8a62f25993a40c923e2db49add55d06d
SHA1 1e820d1ef53e16c3215249ccd5a2b5fde980961b
SHA512 14033cbe2c695faceea3889abed9c2b4b9b32f147746c3165aaf4c0085efb878dd7e1bd0181fb1874ae61101341d74f3c579c7b66193a17d1832c380ee61a00e
MD5 SHA1 SHA512

Submit Download

zCom.resources

Path C:\Users\Admin\AppData\Local\Temp\zCom.resources
Size 62KB
SHA256 b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5
MD5 a26b0f78faa3881bb6307a944b096e91
SHA1 42b01830723bf07d14f3086fa83c4f74f5649368
SHA512 a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c
SSDEEP 1536:sAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtQ:sAtWDDILJLovbicqOq3o+nQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1200-21-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Download

memory/1200-39-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Download

memory/3632-8-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Download

memory/3632-17-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Download

memory/5564-20-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Download

memory/5564-0-0x00000000746F1000-0x00000000746F2000-memory.dmp

Download

memory/5564-1-0x00000000746F0000-0x0000000074CA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads