edb6be3fd6f4e49b8ce4144996db6ca08ac274d777face553ad84fe6c3d21011 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SilverClient.exe
Size

39KB
Sample

240528-ry8anaac76
MD5

7ffade3507754f31e714b13da3af1eab
SHA1

4aa74757a257e0c71f8c770f537cbc3e0c76ecef
SHA256

edb6be3fd6f4e49b8ce4144996db6ca08ac274d777face553ad84fe6c3d21011
SHA512

076b2eabee2961d689b8b4e216d84e7cf048fc8174d30b617dac8fb72b29f755c8cfbf012acb6e3a4e2995aa5a8149694d0c06a197abec111fc3301eb5c66140
SSDEEP

768:a2P7BLBW9U/hnvREaKv34+VnWuPlqJ01c0RU7jTXz1QB6S8gQ1QriOoQSKTt0bE:ZTBYQEaKvpPlH1c0G/1Qonh1FOo5K5GE

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  SilverClient.exe
- Size
  
  39KB
- MD5
  
  7ffade3507754f31e714b13da3af1eab
- SHA1
  
  4aa74757a257e0c71f8c770f537cbc3e0c76ecef
- SHA256
  
  edb6be3fd6f4e49b8ce4144996db6ca08ac274d777face553ad84fe6c3d21011
- SHA512
  
  076b2eabee2961d689b8b4e216d84e7cf048fc8174d30b617dac8fb72b29f755c8cfbf012acb6e3a4e2995aa5a8149694d0c06a197abec111fc3301eb5c66140
- SSDEEP
  
  768:a2P7BLBW9U/hnvREaKv34+VnWuPlqJ01c0RU7jTXz1QB6S8gQ1QriOoQSKTt0bE:ZTBYQEaKvpPlH1c0G/1Qonh1FOo5K5GE
Score

10^/10

evasion trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2