Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2023, 07:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Silver RAT.exe
Resource
win7-20231020-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Silver RAT.exe
Resource
win10v2004-20231023-en
3 signatures
150 seconds
General
-
Target
Silver RAT.exe
-
Size
479KB
-
MD5
eb580bc45a382527d2f1ff80c542bd9d
-
SHA1
0b95c965fe80c9b9d9270be74817a8771bb02daa
-
SHA256
99bd6ee7da4edad447fba55a6b11538927013586ef617e70a0ff4765adae22db
-
SHA512
a3f4563d4ee61a0bdc612c849f13711af961514cbe3ce48ab9af0b905c8df278f470e902bc50b64d95055f2bd69fd288bba1dd0405caf9e4a42585cdf6b3e23c
-
SSDEEP
6144:pTNlPsSiE0grIlHAjNL7S8AtKZnbr8qz6xzS06d17GQxAAXcpGZ5wIzkyOD+lRXs:pFR0gsAjNL6tQbr8w6xely1JcXgDsLm
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4196 dialer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4316 Silver RAT.exe 4316 Silver RAT.exe 4196 dialer.exe 4196 dialer.exe 4196 dialer.exe 4196 dialer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4316 wrote to memory of 4196 4316 Silver RAT.exe 93 PID 4316 wrote to memory of 4196 4316 Silver RAT.exe 93 PID 4316 wrote to memory of 4196 4316 Silver RAT.exe 93 PID 4316 wrote to memory of 4196 4316 Silver RAT.exe 93 PID 4316 wrote to memory of 4196 4316 Silver RAT.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Silver RAT.exe"C:\Users\Admin\AppData\Local\Temp\Silver RAT.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:4196
-