silverrat | a384bad25740a4b783eaadd6ade53d96e878e1313c34321ddfb23149fbf6366d

Analysis

max time kernel
899s
max time network
440s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
16-01-2025 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Silver Rat [Re Lab].7z
Size

10.6MB
MD5

f06813aa321c43a69a04904cfa735a44
SHA1

820a0f9f4c00af6ce2583218019ad14a5c5592e2
SHA256

a384bad25740a4b783eaadd6ade53d96e878e1313c34321ddfb23149fbf6366d
SHA512

72551e22ba2db4759ad905f92f407f7e8266e363aa8627a56d8bcaea83a69a96466269358a034e626581f24c2417fa98bb0bb57472f96c2ea39b2708edaa5bb8
SSDEEP

196608:vGbH8yKZWDv2mzFaZ9+j0PlI6obvU/Y0NK6HLlzcurSGBZ+pbJ:vGTiMLNaLIulI6z/YGJHp76P

Score

10^/10

silverrat agilenet discovery trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

127.0.0.1:9999

Mutex

lAxDBRhAFu

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
bExTREtiUkFJU1VBQkZDcGhFYUlERXlETVVqeVlh
reconnect_delay
4
server_signature
X2bGaIX2LYniQHNuiZ/GDWH2WAPjo6JBlPdruTKo3wAPBEJ7c9p52YHgJUPnAr1f4g/5wuBOuJAiDhcjiBvp5/YjOCvb25I5GR9CYPw/Q1d24lBPVX0Vx4Ns5U7DP1DDLt1jeKUfZ5M7hTyIyBocDPCrfCaQ36utR7TqCeZvKx6q4gZCAa8RJyd7btBmjmL6lbU2cCa5VGVcIXrWbyc8+86XnvZH6f+cL/eckLafy6FT0dtw50+V2DpmJf7hw5arvTY/5+VHgUEXS8txTp0s7TC+BaiRSCVAvxZv5FCzkUSAq1dHk201/ITPw1i3YpIWmKgm9OPw0kbpexyuuYZtH56J73wUtjSXeNJivwl82bDDJMXgaIQZy/fLcSXOMHyPzDeUQkioTmDc8yobDLs8Agdd/EVPvGqZ3ccRA/3TPRNwNscM34hUwwkmR3qU9jbXra//N63KmpBuaTgGn6Hq4NCx3y2f4BFg+WIcI4KkKtZT9KNyVNxqp5UBETfmlg4w3OKf++K27s5g+oBAyKz2GwIidbI5sn/s8I7I9nCCTxVa68bWRTrWYWCeWYO/ba4D2N6eEYqUpEeFVZsagYqy8B2psIHwDdSiOXeew2JtkNSM4qZFi7qD/NT07niJyjbwUe2c6RjZn1LMhhVxsZqWbNqouBRLuihU+J5o1O506jw=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Executes dropped EXE 1 IoCs

pid	Process
2344	SilverRat.exe

Loads dropped DLL 10 IoCs

pid	Process
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe

Obfuscated with Agile.Net obfuscator 4 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/2344-90-0x0000000007AB0000-0x0000000007AFE000-memory.dmp	agile_net
behavioral1/files/0x0028000000046291-89.dat	agile_net
behavioral1/files/0x0028000000046290-101.dat	agile_net
behavioral1/memory/2344-102-0x0000000009FC0000-0x000000000A10E000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SilverRat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SilverRat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SilverRat.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\0\MRUListEx = 00000000ffffffff	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 78003100000000002d5ad96c1100557365727300640009000400efbe874f7748305a57b92e000000fd0100000000010000000000000000003a0000000000d571760055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	SilverRat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	SilverRat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\0\0	SilverRat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\0\0\NodeSlot = "3"	SilverRat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	SilverRat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\0 = 7e00310000000000305a5ab911004465736b746f7000680009000400efbe2d5ad96c305a5ab92e000000020904000000020000000000000000003e000000000081742c014400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\0	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	SilverRat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	SilverRat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	SilverRat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\0\0 = 70003100000000008257b960100053494c5645527e310000580009000400efbe305a5ab9305a69b92e00000083620400000029000000000000000000000000000000c0f6f100530069006c00760065007200200052006100740020005b005200650020004c00610062005d00000018000000	SilverRat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	SilverRat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	SilverRat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	SilverRat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\MRUListEx = 00000000ffffffff	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0\0\0\MRUListEx = ffffffff	SilverRat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0 = 50003100000000002d5a9673100041646d696e003c0009000400efbe2d5ad96c305a57b92e000000f8080400000002000000000000000000000000000000b8e60901410064006d0069006e00000014000000	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\0	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	SilverRat.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	SilverRat.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 19002f433a5c000000000000000000000000000000000000000000	SilverRat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe
2344	SilverRat.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
556	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	556	7zFM.exe
Token: 35	556	7zFM.exe
Token: SeSecurityPrivilege	556	7zFM.exe
Token: SeDebugPrivilege	2344	SilverRat.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
556	7zFM.exe
556	7zFM.exe
556	7zFM.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2344	SilverRat.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 4296	2344	SilverRat.exe	96
PID 2344 wrote to memory of 4296	2344	SilverRat.exe	96
PID 2344 wrote to memory of 4296	2344	SilverRat.exe	96
PID 4296 wrote to memory of 1588	4296	csc.exe	98
PID 4296 wrote to memory of 1588	4296	csc.exe	98
PID 4296 wrote to memory of 1588	4296	csc.exe	98
PID 2344 wrote to memory of 4932	2344	SilverRat.exe	100
PID 2344 wrote to memory of 4932	2344	SilverRat.exe	100
PID 2344 wrote to memory of 4932	2344	SilverRat.exe	100
PID 1184 wrote to memory of 4020	1184	OpenWith.exe	103
PID 1184 wrote to memory of 4020	1184	OpenWith.exe	103

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Silver Rat [Re Lab].7z"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4236

C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe
"C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qywhpi4r\qywhpi4r.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD7F2.tmp" "c:\Users\Admin\Desktop\Silver Rat [Re Lab]\Resources\CSC3206F6D8931458AB645206494611DB.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wciroymp\wciroymp.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4932

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Silver Rat [Re Lab]\stub.cs
  2⤵
  PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESD7F2.tmp

Filesize
1KB

MD5
88bc308db40d5bb2f7d35d629fab3147

SHA1
9de22c5473e9cb4ef1ffeced65ec5a83d4bff807

SHA256
b149905ed8bc02f125a0bf5c714282fac9cd8c147e3f51dded3242c72da241af

SHA512
0ea195f0da3ba8210fa8261952278e58e0ce80ca651b367ac8b767aa120ece72a4cccb19463152bc2272805cc8e7cc105967dba2d9c6cb888bf2e22357af4c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpD6B4.tmp

Filesize
4KB

MD5
e1a48ec781542ab4f0d3a3368b2a1d05

SHA1
a35670f07e5320a1591a55d903b35dcdd1d224a1

SHA256
f41d8818774f3ec0bf936e564f50008b46f5e4060edaab3bd72ffa389fb9ef21

SHA512
d3e756d8b321d38962a7b36af617d152e9bfd499b31f1630a24ada435715ad81a29ab73e4ab4aa21bbc9029b4177a943303e7df922bf375c2583607cb6f6566a

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Bunifu.Licensing.dll

Filesize
1.3MB

MD5
c18a9e44e200c7315a1868caab894293

SHA1
18f65508762d2492f41b22e4e6e5ad19a2226baa

SHA256
661a5be944dc9fb2e0eba01c3c0584feb3ecca44877d77f54d0f409ce801af22

SHA512
9a5e08bb6ed4535ac92ca446b630b29587cb5a4d7d695234a5d93267d2ac13d702b3738ba0e20606f10020e9642e8e315e7ddc92f1c321b68daf8524a3f5f2d1

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Guna.UI2.dll

Filesize
1.4MB

MD5
acec68d05e0b9b6c34a24da530dc07b2

SHA1
015eb32aad6f5309296c3a88f0c5ab1ba451d41e

SHA256
bf72939922afa2cd17071f5170b4a82d05bceb1fc33ce29cdfbc68dbb97f0277

SHA512
d68d3ac62319178d3bc27a0f1e1762fc814a4da65156db90ae17284a99e5d9909e9e6348a4ff9ef0b92a46ba2033b838b75313307b46ab72dc0aab9641e4f700

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Profiles\Builder.xml

Filesize
1KB

MD5
3fcd4ac4720febae7ed0b81913daaf1c

SHA1
7d2ec4090023cc93a453c65782c78fe9bcf5afbd

SHA256
b4b7d0f7878a60e5d641443a7d4720e178568e6febbb38a243d3b9fb8a30842b

SHA512
c6a5c5c5d17d2e56fd2fde8705062a8916673ec5557ef9f30c9f62c67877c72f5b8e4528a3a8a8ec24f74e5c52ed385442483606b13972bcc645257a5826f2ca

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Profiles\SocketPort.xml

Filesize
57B

MD5
5f807862258a390b2e2f75abb6d2c865

SHA1
22abc144aa034c6490cbf143a8f1cdd42bd06d1b

SHA256
7b87c31f6d1163fc236651f5e1f3187cfa0c79d4a85d20c1c05f1dc3056c4823

SHA512
b831e4b2eeec23e39544961cef6619c8d57c50b53dc6bad8846682df6f5252041f50ce33cbe182488288d6d5e2e3e5194055ee4143ceb09f9601ed49d39dba39

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\Resources\EAazgIEJRCfkIxU

Filesize
42KB

MD5
1097c5310f9915b9a0f5ab187d604882

SHA1
4b4690006f7c4d15de377e2cda5475463eb38d98

SHA256
21c319869a9e0fcb5ceba6001459ed090dca27d473d9ab9af38b64bc9d83d124

SHA512
89a603dff89d401ec9fddcc762c84b4b174e6809268327e5014b5345979d586c1e4ee590c4eb8fa2cc388fbd72eeb383b70205c15c29ea9066b59509e20f08bf

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe

Filesize
25.2MB

MD5
d6527f7d5f5152c3f5fff6786e5c1606

SHA1
e8da82b4a3d2b6bee04236162e5e46e636310ec6

SHA256
79a4605d24d32f992d8e144202e980bb6b52bf8c9925b1498a1da59e50ac51f9

SHA512
2b4eb9e66028d263c52b3da42fa3df256cf49cd7a7ebdf7c75da6a2dedfd2c22cb5f2071345b7016cd742539c74a801cad70c612330be79802fa19f860ea2d5f

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\SilverRat.exe.config

Filesize
526B

MD5
d6f1152d647b57f64494c3e1d32ede94

SHA1
a35bd77be82c79a034660df07270467ee109f5ac

SHA256
a47f3f83cdb9816f03632833dc361ac5e7a4c5c923af1fdebfa16303f9d68a72

SHA512
699b5ad93d3497348f8aad8e15d54ddd789bbac43f11a7fb629f19cda3749bee0ae06dc83f4e6246df631488169fda5d15c48585581d3a96d2523b8b45e639bd

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\bunifu.ui.winforms.1.5.3.dll

Filesize
297KB

MD5
c1d51a0e747c9d6156410cb3c5b97a60

SHA1
86312cba2eb3495cc6bec66d54d4ab88596275d8

SHA256
6937052b86bc251be510b110e08fc5089d3bd687ce2333a85ea6d5c2c09b437a

SHA512
a8d7b2e5555c01076e8dd744d21d8cd901aaffad052af0e8c22269e8c2f765019422ed245368a64d64157652a0e4fcab1a889086fde4e139b4ccf5f7bad08222

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\bunifu.ui.winforms.dll

Filesize
1.3MB

MD5
686833fccd95b4f5c8d7695a2d45955d

SHA1
882f60ea47f536c1f01da0f5767dfe5d569fc011

SHA256
578cbcfb7a01234907fb6314918efd23a502882c79d0ee3c2e7d4ae0cf63ebc2

SHA512
8bb3a8741b73ad7c280de31905dbfc449c2d6f538b8feca232201c7079f917c4291936211632bcdf17c95d6cf5d9b97df2cdd21c57af6cbff486ea7691ff3bc1

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\cGeoIp.dll

Filesize
2.3MB

MD5
6d6e172e7965d1250a4a6f8a0513aa9f

SHA1
b0fd4f64e837f48682874251c93258ee2cbcad2b

SHA256
d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0

SHA512
35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155

Download Submit
C:\Users\Admin\Desktop\Silver Rat [Re Lab]\stub.cs

Filesize
84KB

MD5
255787b7316051d866d8a8a384102c9a

SHA1
5a9fe0570579b7fe3916ec51abaa6606cf44dd18

SHA256
1ffef5d31a2d6dbc01177fcf7835c9d9eeb4334bd39b20ec76eb2be1ba429f3f

SHA512
3016709d0ca83b58abadf1db647ff313105fa03e738f016cbb6364fa258c1824bfb692117ce325b1189a73242208fbcb58825c0abc022df06b771ed0937594db

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qywhpi4r\qywhpi4r.0.cs

Filesize
87KB

MD5
ae93a1132c7bf36d766b4bc79ba46ec0

SHA1
72950db2e43ffe688682f85cae0674a62d5d01fa

SHA256
270cee0e47de09e738c99d240969043249fd801370e8bcc30b05aee2b726a1d0

SHA512
85154ad87feaebff5e5c6ccd641f55d412eca24f4c39b181f16554ceb7c154287066e4cecc6baed86cba76850e9e42faec30003b73a075ca9e165626a2d393a5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qywhpi4r\qywhpi4r.cmdline

Filesize
294B

MD5
22c7fe497295fb5f4030369d9814c534

SHA1
ad3f557a8c2892f37ac19f260cbccb19551cc4ba

SHA256
e1600f0bda113ab2455c230bb671f3c4331461d23a9c83fbae3f09120acc0035

SHA512
439c3af4898d45e6f2445eabc7825e32c0bc8b7b7a9bcda6e9e0cc8a89456eb7a365c53a9f751a1a57f87cc460bea7df5da8cc2dc5d3562d4d88b340c9676dde

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wciroymp\wciroymp.0.cs

Filesize
1KB

MD5
0afe6c992b64cbec12518e1793eb51ce

SHA1
2c439f166e7c21810d1d8c9eb47ad521d9bfbf3b

SHA256
4bb926afd3b5ac0d6aba92ae37ed80c8a13b0b3305cb7b34125ca23f4e723f6f

SHA512
97048180c8a923b84e9b1fb64f9167a0fd8aae31cedd06a1aa4dfbedef4bbc67b91e6dd2fb163237285c93b7b923f0de9ef773163085cc33329e887998498b2a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wciroymp\wciroymp.cmdline

Filesize
285B

MD5
368c2f59b0a01015e57b6ec59679433e

SHA1
a41fe11640cecbd5b2369b1f3ff046da4b6dc1f5

SHA256
9416b0fcfb0431d7b5d63172eacfcc9c7f774569cce27188eb8ffe97a1aebe69

SHA512
3b4e5e0d6d61ed670d5d19995deccbb831777209e5dd75b118fc9c4d7c926c7619a324cab568c5c0eba12c610f721fe265561b522093caa04123f2b587754008

Download Submit
\??\c:\Users\Admin\Desktop\Silver Rat [Re Lab]\Resources\CSC3206F6D8931458AB645206494611DB.TMP

Filesize
1KB

MD5
e761f23259484af7739a4c79280d7d03

SHA1
366b7eda1664c998e757e4fe2183d91d5a9fd16e

SHA256
4dfd06665db68ce684673886e72c57183ee7bf627e9db78aa3ff9b574150e17e

SHA512
46f329c7aca920f39d089779bc0838995b9eeac8aa876c0959ac9be9253d9c9874fcfee2a87eb36f9f039a14f66c80734316a43c98932029d194e09faadad92b

Download Submit
memory/2344-97-0x00000000099E0000-0x0000000009A12000-memory.dmp

Filesize
200KB

Download
memory/2344-102-0x0000000009FC0000-0x000000000A10E000-memory.dmp

Filesize
1.3MB

Download
memory/2344-103-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download
memory/2344-98-0x0000000009AB0000-0x0000000009B4C000-memory.dmp

Filesize
624KB

Download
memory/2344-95-0x0000000008050000-0x000000000805A000-memory.dmp

Filesize
40KB

Download
memory/2344-96-0x0000000074770000-0x0000000074F21000-memory.dmp

Filesize
7.7MB

Download
memory/2344-122-0x0000000074770000-0x0000000074F21000-memory.dmp

Filesize
7.7MB

Download
memory/2344-94-0x0000000008060000-0x00000000082B2000-memory.dmp

Filesize
2.3MB

Download
memory/2344-90-0x0000000007AB0000-0x0000000007AFE000-memory.dmp

Filesize
312KB

Download
memory/2344-86-0x0000000007B60000-0x0000000007CB0000-memory.dmp

Filesize
1.3MB

Download
memory/2344-82-0x0000000007890000-0x0000000007A06000-memory.dmp

Filesize
1.5MB

Download
memory/2344-78-0x0000000006DD0000-0x0000000006E62000-memory.dmp

Filesize
584KB

Download
memory/2344-77-0x00000000072E0000-0x0000000007886000-memory.dmp

Filesize
5.6MB

Download
memory/2344-76-0x0000000000A20000-0x000000000234E000-memory.dmp

Filesize
25.2MB

Download
memory/2344-75-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download