silverrat | b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f

General

Target

b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f.exe
Size

227KB
MD5

3ebfd2e63dbdb727badcaee9f86c52bb
SHA1

006c520203e7610d9fed7874c803286c3b81402f
SHA256

b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f
SHA512

483eb63069156a2c5eb004a9602c9a7aa4d99ba714e5f7a7787d8af401ee5bbc5a30deb90196953a61fd61cb50584f8f9b590a9c91364bba6688248c30ca013f
SSDEEP

3072:Emooj7nGTEA3uUq4uEHBAnpK37nX78c0BgHQ7Unpr74tyJhd6KtAn6m7TcSs2oWh:tHGvb8RUp1v+P7ts2oWP

Score

10^/10

silverrat execution trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

C2

hai1723.duckdns.org:7560

Mutex

SilverMutex_NACcsErPbz

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
T293bGdva2RNV1NSTkplemxKVmdNRERIZnBSdW55
payload_url
https://g.top4top.io/p_2522c7w8u1.png
reconnect_delay
1
server_signature
uVfwBVROYvLse9BydYbpQ4qEIVRJZOuJw/m0UevQE77Fbyux2jnKja3rYS7yvdy90NVgej0vrnPprej3ckCtF4k3kAXSWQb6yfcX+O68Pw+jJJ+SR4CFWxRzF+Xt8AQGEg40OggwwUql7o8cgfcf+lVxKvN9+u80Xk/07Ce0lbiUd9wrm+pF7GX24mxN85OsaD8YyZ3PdK3pUeLWrwKuf00WQ5i0XxdDd+Svvv2TG87l+ydSnpvg+vFc1VwrH0zHwORlX4yxNzbfJW4o9xw5SoLdWKN4R+H3NsqTFvMsPS1jqUeh0kaGhEYQsbXiKMfRJm7A1tF0JgANaE2rCGtA8jqyyhUq5E5qCWlHpKjMurzX4pD8/OVSpUDnMs0Sgpqrk+Jio6cFbJclsblS1ozLpUUt5xpmM8wG4g0FvYXQ3PofyMAOjkGHTkhf+CavcCnHOfvWuZyTeMtwg69pisv71eYNsNE701AvMgkPEvNkB1217ktRaQnYb8tNvfRk2zqyYSj+UwnkVRpeyT8V760HwISUs6rF0G+jbQDFquFBDoISkHMInpgORs0skC/ByxPBVGYAdp9EkkBozf180f+L5gcdgiIf5CZBH3yXQQAUPdkpwPgNwdor2/rDMUhthuSIRPnfIMbJyduFOUf/PCFdexiHkJbA9GBDLbOf9uys2cs=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
436	powershell.exe
1564	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f.exe

Executes dropped EXE 1 IoCs

pid	Process
5172	T_T.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
436	powershell.exe
436	powershell.exe
1564	powershell.exe
1564	powershell.exe
5172	T_T.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	5172	T_T.exe
Token: SeDebugPrivilege	5172	T_T.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5172	T_T.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 436	3292	b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f.exe	85
PID 3292 wrote to memory of 436	3292	b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f.exe	85
PID 3292 wrote to memory of 1564	3292	b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f.exe	87
PID 3292 wrote to memory of 1564	3292	b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f.exe
"C:\Users\Admin\AppData\Local\Temp\b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\T_T.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'T_T.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1564

C:\ProgramData\T_T.exe
C:\ProgramData\T_T.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\T_T.exe

Filesize
227KB

MD5
3ebfd2e63dbdb727badcaee9f86c52bb

SHA1
006c520203e7610d9fed7874c803286c3b81402f

SHA256
b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f

SHA512
483eb63069156a2c5eb004a9602c9a7aa4d99ba714e5f7a7787d8af401ee5bbc5a30deb90196953a61fd61cb50584f8f9b590a9c91364bba6688248c30ca013f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b7e1db446e63a2aae76cd85440a08856

SHA1
c900cc81335dd3ca6337e21f5bcde80f8e8a88f3

SHA256
7305bcde3ba246a9b5c1666079c61596cc2ed2c651a1cd9e20557dba8a78c0e4

SHA512
dd63e28017eec632868489e469dd2ba54f20a3024be44550b729a0384bd55c5aa78171f7416612cd5174047afc544e21678ca164359962312b1d853c9bff04ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w0vkbika.gv3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/436-12-0x00007FFD4B4D0000-0x00007FFD4BF91000-memory.dmp

Filesize
10.8MB

Download
memory/436-13-0x00007FFD4B4D0000-0x00007FFD4BF91000-memory.dmp

Filesize
10.8MB

Download
memory/436-14-0x00007FFD4B4D0000-0x00007FFD4BF91000-memory.dmp

Filesize
10.8MB

Download
memory/436-17-0x00007FFD4B4D0000-0x00007FFD4BF91000-memory.dmp

Filesize
10.8MB

Download
memory/436-2-0x0000023349B90000-0x0000023349BB2000-memory.dmp

Filesize
136KB

Download
memory/3292-0-0x00007FFD4B4D3000-0x00007FFD4B4D5000-memory.dmp

Filesize
8KB

Download
memory/3292-32-0x00007FFD4B4D0000-0x00007FFD4BF91000-memory.dmp

Filesize
10.8MB

Download
memory/3292-1-0x0000000000780000-0x00000000007C0000-memory.dmp

Filesize
256KB

Download
memory/3292-36-0x00007FFD4B4D0000-0x00007FFD4BF91000-memory.dmp

Filesize
10.8MB

Download
memory/5172-37-0x0000000000DA0000-0x0000000000DAE000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing