sliver | 277c2405bb6dcf4887fe68a25e960ffb424884b19e357b13229787825fe0b7d5

Analysis

max time kernel
303s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 08:39

Target

malware-edited.7z
Size

468KB
MD5

8cf32514ef6c2069470034a267f3b00c
SHA1

645f0c1552723040d13e24991b2f26c6e1946746
SHA256

277c2405bb6dcf4887fe68a25e960ffb424884b19e357b13229787825fe0b7d5
SHA512

dab7053f924f843e4839091dfdc36a84903b5fcda81d58d042ef841d206f85e1f4a433443caa42a3478da0a5b439c31a4c9e2f4ca10eca88050e91f87b49efc3
SSDEEP

12288:7Uqr5FU1fO7jiD6RYC+m7gK85fYd6kZatp:7Uq5FUhO7o7C/gh5tkZaD

Score

10^/10

Sliver RAT v2 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1556-50-0x0000024FED500000-0x0000024FEE033000-memory.dmp	SliverRAT_v2
behavioral1/memory/1556-54-0x0000024FF07A0000-0x0000024FF133F000-memory.dmp	SliverRAT_v2
behavioral1/memory/1556-55-0x0000024FF07A0000-0x0000024FF133F000-memory.dmp	SliverRAT_v2
behavioral1/memory/1556-53-0x0000024FF07A0000-0x0000024FF133F000-memory.dmp	SliverRAT_v2
behavioral1/memory/1556-56-0x0000024FF07A0000-0x0000024FF133F000-memory.dmp	SliverRAT_v2

SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
trojan backdoor sliver
Executes dropped EXE 1 IoCs

Processes:

.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe

pid process

3212 .1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

4796 7zFM.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 4796 7zFM.exe
Token: 35 4796 7zFM.exe
Token: SeSecurityPrivilege 4796 7zFM.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

4796 7zFM.exe
4796 7zFM.exe

pid	process
3212	.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe

pid	process
4796	7zFM.exe

pid	process
4796	7zFM.exe
4796	7zFM.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1 - Copy.exe.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe

description	pid	process	target process
PID 5036 wrote to memory of 3212	5036	1 - Copy.exe	.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe
PID 5036 wrote to memory of 3212	5036	1 - Copy.exe	.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe
PID 5036 wrote to memory of 1556	5036	1 - Copy.exe	cmd.exe
PID 5036 wrote to memory of 1556	5036	1 - Copy.exe	cmd.exe
PID 5036 wrote to memory of 1556	5036	1 - Copy.exe	cmd.exe
PID 5036 wrote to memory of 1556	5036	1 - Copy.exe	cmd.exe
PID 3212 wrote to memory of 2160	3212	.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe	cmd.exe
PID 3212 wrote to memory of 2160	3212	.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe	cmd.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2076

C:\Users\Public\Downloads\1 - Copy.exe
"C:\Users\Public\Downloads\1 - Copy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe
  "C:\Users\Admin\AppData\Local\Temp\.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe" 376 "C:\Users\Admin\AppData\Local\Temp\.1 - Copy.bgdjveeoaoqbozlbiyumoktburkyommm.__relocated__.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c exit
    3⤵
    PID:2160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1556

C:\Users\Admin\AppData\Local\Temp\.1 - Copy.ffxpdpcljwstczdkrpfigunfxzkblfcu.__selfdelete__.exe

Filesize
1.3MB

MD5
b59b1bb4ca3fd39ad225aad30e1f49ce

SHA1
c6b95cb11c78f29adbbee5df4fdd766d75fd0c8d

SHA256
b6e472df537492e9bb591d531d6ee8a69ec94849a6aec7726a88074e4c097f6b

SHA512
6611373ce5b54005adc739315168ce42c543b64aacc1f0e750a8067a2eec10d13d8c97334797bf8a76469b706c09b44ac7dec559d9ca0389e839e5077aefef4e

Download Submit
memory/1556-50-0x0000024FED500000-0x0000024FEE033000-memory.dmp

Filesize
11.2MB

Download
memory/1556-54-0x0000024FF07A0000-0x0000024FF133F000-memory.dmp

Filesize
11.6MB

Download
memory/1556-55-0x0000024FF07A0000-0x0000024FF133F000-memory.dmp

Filesize
11.6MB

Download
memory/1556-53-0x0000024FF07A0000-0x0000024FF133F000-memory.dmp

Filesize
11.6MB

Download
memory/1556-56-0x0000024FF07A0000-0x0000024FF133F000-memory.dmp

Filesize
11.6MB

Download
memory/3212-7-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/3212-52-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/5036-6-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/5036-48-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/5036-51-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download