Overview
overview
10Static
static
10Silver RAT...pi.vbs
windows10-2004-x64
1Silver RAT...er.exe
windows10-2004-x64
7Silver RAT...le.bat
windows10-2004-x64
1Silver RAT...AT.exe
windows10-2004-x64
7Silver RAT...or.dll
windows10-2004-x64
1Silver RAT...ata.js
windows10-2004-x64
1Silver RAT...oty.js
windows10-2004-x64
1Silver RAT...oty.js
windows10-2004-x64
1Silver RAT...min.js
windows10-2004-x64
1Silver RAT...min.js
windows10-2004-x64
1Silver RAT...min.js
windows10-2004-x64
1Silver RAT...ber.js
windows10-2004-x64
1Silver RAT...ogs.js
windows10-2004-x64
1Silver RAT...x.html
windows10-2004-x64
1Silver RAT...der.js
windows10-2004-x64
1Silver RAT...in.ps1
windows10-2004-x64
1Silver RAT...ers.js
windows10-2004-x64
1Silver RAT...en.ps1
windows10-2004-x64
1Silver RAT...ats.js
windows10-2004-x64
1Silver RAT...an.exe
windows10-2004-x64
1Silver RAT...px.exe
windows10-2004-x64
7Silver RAT...l3.dll
windows10-2004-x64
1Silver RAT...40.dll
windows10-2004-x64
3Silver RAT...n3.dll
windows10-2004-x64
3Silver RAT...40.dll
windows10-2004-x64
1Silver RAT...min.js
windows10-2004-x64
1Silver RAT...ats.js
windows10-2004-x64
1Silver RAT...ats.js
windows10-2004-x64
1Silver RAT...ker.js
windows10-2004-x64
1Silver RAT...ub.exe
windows10-2004-x64
10Analysis
-
max time kernel
66s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2023 09:33
Behavioral task
behavioral1
Sample
Silver RAT V1.0/.peu/New Project 1/src/PebApi.vbs
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
Silver RAT V1.0/Loader.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
Silver RAT V1.0/Server/compile.bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral4
Sample
Silver RAT V1.0/Silver RAT.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
Silver RAT V1.0/SimpleObfuscator.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral6
Sample
Silver RAT V1.0/admin/dist/js/daterangepicker-data.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
Silver RAT V1.0/admin/dist/js/noty/noty.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
Silver RAT V1.0/admin/dist/js/noty/noty.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
Silver RAT V1.0/admin/dist/js/noty/noty.min.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
Silver RAT V1.0/admin/dist/js/noty/noty.min.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral11
Sample
Silver RAT V1.0/admin/dist/js/select2/select2.min.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral12
Sample
Silver RAT V1.0/admin/grabber.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
Silver RAT V1.0/admin/js/logs.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
Silver RAT V1.0/admin/lang-packs/index.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
Silver RAT V1.0/admin/loader.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral16
Sample
Silver RAT V1.0/admin/main.ps1
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
Silver RAT V1.0/admin/markers.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral18
Sample
Silver RAT V1.0/admin/open.ps1
Resource
win10v2004-20231025-en
Behavioral task
behavioral19
Sample
Silver RAT V1.0/admin/stats.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral20
Sample
Silver RAT V1.0/bin/clean.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral21
Sample
Silver RAT V1.0/bin/upx.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral22
Sample
Silver RAT V1.0/libs/freebl3.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral23
Sample
Silver RAT V1.0/libs/msvcp140.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral24
Sample
Silver RAT V1.0/libs/softokn3.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
Silver RAT V1.0/libs/vcruntime140.dll
Resource
win10v2004-20231020-en
Behavioral task
behavioral26
Sample
Silver RAT V1.0/stats/dist/js/select2/select2.min.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral27
Sample
Silver RAT V1.0/stats/js/stats.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral28
Sample
Silver RAT V1.0/stats/stats.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral29
Sample
Silver RAT V1.0/stats/vendors/daterangepicker/daterangepicker.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral30
Sample
Silver RAT V1.0/stub.exe
Resource
win10v2004-20231020-en
General
-
Target
Silver RAT V1.0/Loader.exe
-
Size
479KB
-
MD5
eb580bc45a382527d2f1ff80c542bd9d
-
SHA1
0b95c965fe80c9b9d9270be74817a8771bb02daa
-
SHA256
99bd6ee7da4edad447fba55a6b11538927013586ef617e70a0ff4765adae22db
-
SHA512
a3f4563d4ee61a0bdc612c849f13711af961514cbe3ce48ab9af0b905c8df278f470e902bc50b64d95055f2bd69fd288bba1dd0405caf9e4a42585cdf6b3e23c
-
SSDEEP
6144:pTNlPsSiE0grIlHAjNL7S8AtKZnbr8qz6xzS06d17GQxAAXcpGZ5wIzkyOD+lRXs:pFR0gsAjNL6tQbr8w6xely1JcXgDsLm
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
dialer.exepid process 4060 dialer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Loader.exedialer.exepid process 4032 Loader.exe 4032 Loader.exe 4060 dialer.exe 4060 dialer.exe 4060 dialer.exe 4060 dialer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Loader.exedescription pid process target process PID 4032 wrote to memory of 4060 4032 Loader.exe dialer.exe PID 4032 wrote to memory of 4060 4032 Loader.exe dialer.exe PID 4032 wrote to memory of 4060 4032 Loader.exe dialer.exe PID 4032 wrote to memory of 4060 4032 Loader.exe dialer.exe PID 4032 wrote to memory of 4060 4032 Loader.exe dialer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Silver RAT V1.0\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Silver RAT V1.0\Loader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:4060