silverrat | c821bbc30312685455eee869000588f598eb5016029730d33db11cdf82a4e132

General

Target

SilverClient.exe
Size

38KB
MD5

71cfd19b2ac1363de384769bdd9108df
SHA1

3ce573ec493a43f216eebe1a04cb28e44071109c
SHA256

c821bbc30312685455eee869000588f598eb5016029730d33db11cdf82a4e132
SHA512

83f6fa85455da132f810fc1ea174ba6c903c01355fb56106956304e96f0507d5d9525b87f261f7f6d6455e5bd47162cbba536a8bc99ebad2831010daf0839316
SSDEEP

768:TWEDD5eEmGLDT3QyLCTi1EWghY5jAnCRUC9fqAAB6SLxUr1E:TvD1L1CeEthk8nCGC9SAAoaxUr1E

Score

10^/10

silverrat trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

C2

austin22-62046.portmap.host:62046

Mutex

SilverMutex_zSgoXCAVYC

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
UnpDa0Fwa0N1amFLQ25ZaHd4bXhqZElyaVNURFBH
reconnect_delay
5
server_signature
lKJRDEdVmh8Pn3VnOSBuMcjBL89jdHU/KmDksaRCBteu3nIut4bln04rpKol4nE+wlfcVNSHZOBSxUjlBYYWL6LuyNLPXyPxX4Rl/hWW3Gfg3DeUryY6Q3qXwuwLR45i0m90D4BbiF7IZSS/NRD8YV+fJ1AQebT9xo7Nv4bpArm4Y8/p/zwlxGVNxlmMXl9bRZcZ0fD5obV9Gl9Z2wTL8MfqA08omz+k453Rb+tUcoSZvgZ7OrenkTSojy3GD+dD5LahGV0bGmydtQtqxNKWSZWD26/HiCo7mFu9Si6n0wTXZNgcpTxen8WYAFl0rI/KoLVPzPbS1gBgn2kwUXeNe6SaDfz2HES0kGHrhitNoz6kXbP+1JaRDhbbyKui3c6jBbM85QKsjMJ5ube4z3s5wl/xAd/NnVaAjihjcrOhInblZ3ELoNZZkQ1/i0Rwb2TKzKkr8XRDJkyOq/BHFRbjNMTdZTwpxSsf27cuGgsP3Vuz/7iSLJzSVDgpPeGjnW6G/Bv05Lt5V8DX/QXSff+0rTmcG88Bz5HhQX0PnxcUEfO8GqRzgCruSRt71m9Zs/KFWS/1Izqg3ug35RuR0k81DS+LGRKLilL6G6cn43II1vcTT6DcY59xESFyIAILH6oA2d4mfSURLMFg9z4vos9rUZJqbKNjFRte8fWzElJY8YU=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
8	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1632	SilverClient.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	SilverClient.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	SilverClient.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 4820	1632	SilverClient.exe	70
PID 1632 wrote to memory of 4820	1632	SilverClient.exe	70
PID 1632 wrote to memory of 8	1632	SilverClient.exe	72
PID 1632 wrote to memory of 8	1632	SilverClient.exe	72
PID 1632 wrote to memory of 4544	1632	SilverClient.exe	74
PID 1632 wrote to memory of 4544	1632	SilverClient.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SilverClient.exe
"C:\Users\Admin\AppData\Local\Temp\SilverClient.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /TN SilverClient.exe
  2⤵
  PID:4820
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /SC ONCE /TN "SilverClient.exe" /TR "C:\Users\Admin\AppData\Local\Temp\SilverClient.exe \"\SilverClient.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:8
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /TN SilverClient.exe
  2⤵
  PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-0-0x00007FF98D083000-0x00007FF98D084000-memory.dmp

Filesize
4KB

Download
memory/1632-1-0x0000000000C30000-0x0000000000C3E000-memory.dmp

Filesize
56KB

Download
memory/1632-2-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/1632-3-0x00007FF98D083000-0x00007FF98D084000-memory.dmp

Filesize
4KB

Download
memory/1632-4-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads