Analysis
-
max time kernel
306s -
max time network
306s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
05-12-2023 01:47
General
-
Target
SilverRAT_Cracked.zip
-
Size
19.9MB
-
MD5
16ec66ff42a4dc6de8378d24cb6162df
-
SHA1
0755d6015feb665554a7568246cd1119d90e6007
-
SHA256
4d8ba52f4b0199bec10b90f156a7f56c87200d94c1bbff2f4c6ba53bea4b51ac
-
SHA512
5fcd035491bb75039dfdcafd54bc86e7aa524cd88d5a04b13757f23a006ec902f564f08ac59c9bb34cb2a059c09d69058883ea8b1dba622134d48544bc108838
-
SSDEEP
393216:rO+hpxoY/hFNqfeHJVOUQrSmQoKMn2ruEfxaPHD4dzu1zDrh7txMDKIZ/YnS:rO+zxdprpVOUSTpKDhfsPj7N7tGDDZgS
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
AgentTesla payload 1 IoCs
-
Async RAT payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SilverRAT_Cracked.zip1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SilverRAT_Cracked.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\SilverRAT.exe"C:\Users\Admin\Desktop\SilverRAT.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\Desktop\SilverRAT.exe"C:\Users\Admin\Desktop\SilverRAT.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5e1a48ec781542ab4f0d3a3368b2a1d05
SHA1a35670f07e5320a1591a55d903b35dcdd1d224a1
SHA256f41d8818774f3ec0bf936e564f50008b46f5e4060edaab3bd72ffa389fb9ef21
SHA512d3e756d8b321d38962a7b36af617d152e9bfd499b31f1630a24ada435715ad81a29ab73e4ab4aa21bbc9029b4177a943303e7df922bf375c2583607cb6f6566a
-
Filesize
3KB
MD5d4057e02d7a73c0f96748def4072d381
SHA14dcc074df8483904c9340135077da8375031b984
SHA2560e2acb6ecc5e99061ecd6faec400c63d08262b5469eba5e45c1707c2e85232c3
SHA512c36202d64ab45ea17032458551fe212406bcbfc083a27fd3db64a2d00a7234ed2e3e3e42d5ca511696c269090e1ea5281ddac45523b3b0db91aca63bb7a4ec54
-
Filesize
25B
MD5596ac840f0e04b8056a6107a0eb65346
SHA1d2d009a5caf0a9298d5ef6f6aa936374fe66fc9c
SHA2569a7631592783caf01a542e6c96aa267142b3be39947f8045e5655af9f8017387
SHA5120e87b5e053d48b654e83ad7397f89437251d3173973e48c34c2ecce557d337fff66464d48319693e73786cdaea7337952a38857ce21b257a0ea49ca8cf420bcc
-
Filesize
385B
MD5c15dc1ae9b61deba9686750ba7cd1837
SHA1cd358e23062373da5815b2aee6157ace3cc82ac0
SHA256eb3cc1e121bfec51d0d68ed48428e52c57787429a49a0aa18f9bf0a2f21b43eb
SHA5124e8dc2084ec42cd2aeef08eb1f83304de7464d96321ca2793e982aeae1811b85700b63db9076c56db5fa60ceb44f36f74a5d0a3b3c4914f94e8ecdfa56eb3d5c
-
Filesize
497B
MD5682c8d3b15ee9eee7bad14e649fabbe6
SHA19f7caf28aab0a37118a53a68abb52211e9488bd1
SHA256a938fe117a71d124214206b16a032b817739fcd9ceaa4108e3dc82aac4001b63
SHA512a833847842e6495bfcea6be4d35acd6a93329cd229d18eb6dd28625542957dddfaf928dc7635981e5078b06dfaa351b3839e194207a16c4a763ac956c59142da
-
Filesize
497B
MD5682c8d3b15ee9eee7bad14e649fabbe6
SHA19f7caf28aab0a37118a53a68abb52211e9488bd1
SHA256a938fe117a71d124214206b16a032b817739fcd9ceaa4108e3dc82aac4001b63
SHA512a833847842e6495bfcea6be4d35acd6a93329cd229d18eb6dd28625542957dddfaf928dc7635981e5078b06dfaa351b3839e194207a16c4a763ac956c59142da
-
Filesize
498B
MD57105e32f4f78958134ba187d4cc0979f
SHA1e66f97fc9ccb7894c9db76cd74245eed03113c50
SHA2560033ba6a35865198026cead89e8f1164fc154b036fde454ad15881a421b69da3
SHA512735647f3559f204038af69b9275eebb3dbd3429841a2c22836101d0abd95da3903f7135f95b74f82a1f3c43a751045296682baf5280209bcc568322704dc16c1
-
Filesize
498B
MD5b4cc1a8c4b2660480068dd4c40339867
SHA1f2a63e7f04527a16e32f8c9183b417845dcdbb0f
SHA2563d3e94fa1814c3b7b2ccb9abc9136adf7fc49a01a2383d730c8c182f32c7d21a
SHA512863a7fd078e9d74fe612767bc925742567ab4ffbb2cffc6d21d2d9dbc9015341202b28362f45d46e975ece4bf249a4e34e81be85a11b23ca0e7535b5b2a93dad
-
Filesize
57B
MD59851f1c59eddcfd01d468646e54e23ee
SHA19531f5e37b1412431b8862f846c704fd8cdf9e57
SHA256890dfcd54a23c360bb6bf0773d380bce9903f4980cfe218508538e7a578c2989
SHA512808b354de380f0d9893db5c9b558b33a823beb3eb6b8b951a4d4d54e1ca7d0fe3bfaa92ef4329c4554ca341971d9a5d68dead0896d347d4be5765c27bd434c14
-
Filesize
57B
MD59851f1c59eddcfd01d468646e54e23ee
SHA19531f5e37b1412431b8862f846c704fd8cdf9e57
SHA256890dfcd54a23c360bb6bf0773d380bce9903f4980cfe218508538e7a578c2989
SHA512808b354de380f0d9893db5c9b558b33a823beb3eb6b8b951a4d4d54e1ca7d0fe3bfaa92ef4329c4554ca341971d9a5d68dead0896d347d4be5765c27bd434c14
-
Filesize
354KB
MD575095ba0f4bea4e8ef020c6979ee1fd7
SHA1f457cbb43d646a04f9d59207ff77091337217646
SHA256040655fecce4cdc0ac7b28967abcd16590c6650accc43f117d73dcc521c2e388
SHA512430c22d598b874172c7e71fce43219af1c531408eb62841a54cdff6d6919a063a5507f289438da0347bddc03b4420ec401e83bb95aed250a78471d635942f2f7
-
Filesize
19.9MB
MD55f7063dedfda5c9d99fed5a824cecaf3
SHA178810dae4c4e8f2732d9e368e38544ffea0d8484
SHA256a9fa8e14080792b67a12f682a336c0ea9ff463bbcb27955644c6fcaf80023641
SHA512c619d216e4b8db978ffdf3dca10048d582bf0e35fc56b8240b73228363cebb119b19ea14a5a7166f196fc9ea2f11cd1727b8badd077a911e0237d4a3bfa6201a
-
Filesize
19.9MB
MD55f7063dedfda5c9d99fed5a824cecaf3
SHA178810dae4c4e8f2732d9e368e38544ffea0d8484
SHA256a9fa8e14080792b67a12f682a336c0ea9ff463bbcb27955644c6fcaf80023641
SHA512c619d216e4b8db978ffdf3dca10048d582bf0e35fc56b8240b73228363cebb119b19ea14a5a7166f196fc9ea2f11cd1727b8badd077a911e0237d4a3bfa6201a
-
Filesize
136KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
20KB
-
Filesize
256KB
-
Filesize
14.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1.1MB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
1.3MB
-
Filesize
20KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
1.1MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4KB