silverrat | 57ac4fcdd291af70d43b28025bbf95a4d4ac1d0955b075f159e97dcfe7685740

General

Target

Windows Security Notification.exe
Size

86KB
MD5

434184cbd1ab6d8b3e6d04d69df75f4f
SHA1

39788e96ff6c0a7f1e7e257715e64b696198151b
SHA256

57ac4fcdd291af70d43b28025bbf95a4d4ac1d0955b075f159e97dcfe7685740
SHA512

4dcd69e84e8b031d83953a9165745c6daba6538cfebf4e76cf6f7f3f92aef4d334013be15d2b20bd4d126994059e1c1d1733ab444954ff3cf26e99f912c01c2c
SSDEEP

768:nMWKyi7didYfW/QdVXxRWl7H2+ZKJ7smhQpq/BRUT0fk9wGluB6SrDDv6/bB2Lj9:nMe2YVHYDCpwGAc9mokDDS/l2Lj9

Score

10^/10

silverrat evasion persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

C2

policies-beside.gl.at.ply.gg:9967

Mutex

xhhCQtIByF

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
discord
https://discord.com/api/webhooks/1307565056380108840/pkpOqO-Y8vruO8aeIu53yzS3l1IFMwpDSYDrGkNa1byaHAiKSa4-gLYX_DpLfjxLj0q9
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
RFNmZ1JPaXBaQXBxS05BdUdsQWNWU0VHREZSbmRK
payload_url
https://g.top4top.io/p_2522c7w8u1.png
reconnect_delay
4
server_signature
LU2wsiaOZ+/gZCLn0p/f7HnmbeuGF/B6ewFYcy0TAoCbL4cHqQZDETE02FQQQOpK0ycwb+sWB6hmbN5YVwd5kelF++2dUp3hd3yuGDK5LGIXWBz+kDFpcPCj87CLCJRnsV5khSfdXX9dLF5Iq0+fMAJb5S3M7kMYTsLsEP19/AWVP8WG1ZzsQMrjEZXfiXYvM1317wLwiXYPMy+spia0hVEZl7sXN7oM09PyHBVF2AYlmggjBUUkLVvhXasGKhBltrgdopTpGkPVUI1wr6Vaj0V55MG85DmcxRl6c99Tnn8/mi7xx1GOIki2wSrwXHf0LTW+EaPhc/JrdrZxlJtWZHRsGJGORjeN+sk4/p3rXWGvT3j8Wl44vyZAEmkJzOsWaDB6Mqnhf1BC+HfGjTayVUD+Rosklv3ZAwGhl4X9kN/Zv9oyfs0686LvfL5eGTRoidP0vr5NBsISTuJ6UFZ3qfIBaEVc97kNbntqIUj/jIy9AJr9/qgPCTLBPmaqiFYqlKcySYG9FcEvHosS08+vKgjs6tXypcocqOgacjWjg2/C/1RLqwrFSbucdNkvG0d5IFHHniydWX4aRcSpT1F3DRFW+uY1TpEPLpL/SZdgown4ZwlGCgkxjo/TPOADHZBYY1fqqqXbXO1nxQew+sspmqw4pz2Gb+XXUQmK2cq71xQ=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1260	attrib.exe
1144	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2896	$77Windows Security Notification.exe

Loads dropped DLL 1 IoCs

pid	Process
2604	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\Windows Security Notification\\$77Windows Security Notification.exe\""	Windows Security Notification.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	discord.com
5	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2716	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2508	Windows Security Notification.exe
2508	Windows Security Notification.exe
2508	Windows Security Notification.exe
2896	$77Windows Security Notification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	Windows Security Notification.exe
Token: SeDebugPrivilege	2896	$77Windows Security Notification.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	$77Windows Security Notification.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1260	2508	Windows Security Notification.exe	30
PID 2508 wrote to memory of 1260	2508	Windows Security Notification.exe	30
PID 2508 wrote to memory of 1260	2508	Windows Security Notification.exe	30
PID 2508 wrote to memory of 1144	2508	Windows Security Notification.exe	32
PID 2508 wrote to memory of 1144	2508	Windows Security Notification.exe	32
PID 2508 wrote to memory of 1144	2508	Windows Security Notification.exe	32
PID 2508 wrote to memory of 2604	2508	Windows Security Notification.exe	35
PID 2508 wrote to memory of 2604	2508	Windows Security Notification.exe	35
PID 2508 wrote to memory of 2604	2508	Windows Security Notification.exe	35
PID 2604 wrote to memory of 2716	2604	cmd.exe	37
PID 2604 wrote to memory of 2716	2604	cmd.exe	37
PID 2604 wrote to memory of 2716	2604	cmd.exe	37
PID 2604 wrote to memory of 2896	2604	cmd.exe	38
PID 2604 wrote to memory of 2896	2604	cmd.exe	38
PID 2604 wrote to memory of 2896	2604	cmd.exe	38
PID 2896 wrote to memory of 2768	2896	$77Windows Security Notification.exe	39
PID 2896 wrote to memory of 2768	2896	$77Windows Security Notification.exe	39
PID 2896 wrote to memory of 2768	2896	$77Windows Security Notification.exe	39
PID 2896 wrote to memory of 2496	2896	$77Windows Security Notification.exe	41
PID 2896 wrote to memory of 2496	2896	$77Windows Security Notification.exe	41
PID 2896 wrote to memory of 2496	2896	$77Windows Security Notification.exe	41
PID 2896 wrote to memory of 2616	2896	$77Windows Security Notification.exe	43
PID 2896 wrote to memory of 2616	2896	$77Windows Security Notification.exe	43
PID 2896 wrote to memory of 2616	2896	$77Windows Security Notification.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1260	attrib.exe
1144	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Windows Security Notification.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Security Notification.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Windows Security Notification"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1260
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1144
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpE1C7.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2716
- - C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe
    "C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /TN $77Windows Security Notification.exe
      4⤵
      PID:2768
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "$77Windows Security Notification.exe" /TR "C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe \"\$77Windows Security Notification.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2496
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /query /TN $77Windows Security Notification.exe
      4⤵
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE1C7.tmp.bat

Filesize
190B

MD5
92ab4f40a56877bf77dd37578483d6f7

SHA1
52ba205d3208f6bfe9045fcd551b3042930db25f

SHA256
b50288fdb4042c2f00a8e87091fe4a3b020771c92e163017afa083358bb0da10

SHA512
eda9ca0c9a001785c501648ada8f4f13859f2efa9285ceb52cadc9f43e6a4a9a38b87e7e525156ecff95b8536075b5bc3123672b7e118b8eb0e8831dfd291d4b

Download Submit
\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe

Filesize
86KB

MD5
434184cbd1ab6d8b3e6d04d69df75f4f

SHA1
39788e96ff6c0a7f1e7e257715e64b696198151b

SHA256
57ac4fcdd291af70d43b28025bbf95a4d4ac1d0955b075f159e97dcfe7685740

SHA512
4dcd69e84e8b031d83953a9165745c6daba6538cfebf4e76cf6f7f3f92aef4d334013be15d2b20bd4d126994059e1c1d1733ab444954ff3cf26e99f912c01c2c

Download Submit
memory/2508-0-0x000007FEF4FC3000-0x000007FEF4FC4000-memory.dmp

Filesize
4KB

Download
memory/2508-1-0x000000013F0D0000-0x000000013F0EA000-memory.dmp

Filesize
104KB

Download
memory/2508-2-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download
memory/2508-3-0x000007FEF4FC3000-0x000007FEF4FC4000-memory.dmp

Filesize
4KB

Download
memory/2508-4-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download
memory/2508-14-0x000007FEF4FC0000-0x000007FEF59AC000-memory.dmp

Filesize
9.9MB

Download
memory/2896-19-0x000000013FF00000-0x000000013FF1A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads