silverrat | b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
23/03/2025, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rc (2) (1).exe
Size

227KB
MD5

3ebfd2e63dbdb727badcaee9f86c52bb
SHA1

006c520203e7610d9fed7874c803286c3b81402f
SHA256

b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f
SHA512

483eb63069156a2c5eb004a9602c9a7aa4d99ba714e5f7a7787d8af401ee5bbc5a30deb90196953a61fd61cb50584f8f9b590a9c91364bba6688248c30ca013f
SSDEEP

3072:Emooj7nGTEA3uUq4uEHBAnpK37nX78c0BgHQ7Unpr74tyJhd6KtAn6m7TcSs2oWh:tHGvb8RUp1v+P7ts2oWP

Score

10^/10

silverrat execution trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

hai1723.duckdns.org:7560

Mutex

SilverMutex_NACcsErPbz

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
T293bGdva2RNV1NSTkplemxKVmdNRERIZnBSdW55
payload_url
https://g.top4top.io/p_2522c7w8u1.png
reconnect_delay
1
server_signature
uVfwBVROYvLse9BydYbpQ4qEIVRJZOuJw/m0UevQE77Fbyux2jnKja3rYS7yvdy90NVgej0vrnPprej3ckCtF4k3kAXSWQb6yfcX+O68Pw+jJJ+SR4CFWxRzF+Xt8AQGEg40OggwwUql7o8cgfcf+lVxKvN9+u80Xk/07Ce0lbiUd9wrm+pF7GX24mxN85OsaD8YyZ3PdK3pUeLWrwKuf00WQ5i0XxdDd+Svvv2TG87l+ydSnpvg+vFc1VwrH0zHwORlX4yxNzbfJW4o9xw5SoLdWKN4R+H3NsqTFvMsPS1jqUeh0kaGhEYQsbXiKMfRJm7A1tF0JgANaE2rCGtA8jqyyhUq5E5qCWlHpKjMurzX4pD8/OVSpUDnMs0Sgpqrk+Jio6cFbJclsblS1ozLpUUt5xpmM8wG4g0FvYXQ3PofyMAOjkGHTkhf+CavcCnHOfvWuZyTeMtwg69pisv71eYNsNE701AvMgkPEvNkB1217ktRaQnYb8tNvfRk2zqyYSj+UwnkVRpeyT8V760HwISUs6rF0G+jbQDFquFBDoISkHMInpgORs0skC/ByxPBVGYAdp9EkkBozf180f+L5gcdgiIf5CZBH3yXQQAUPdkpwPgNwdor2/rDMUhthuSIRPnfIMbJyduFOUf/PCFdexiHkJbA9GBDLbOf9uys2cs=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5868	powershell.exe
216	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	rc (2) (1).exe

Executes dropped EXE 1 IoCs

pid	Process
2236	T_T.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5868	powershell.exe
5868	powershell.exe
216	powershell.exe
216	powershell.exe
2236	T_T.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	rc (2) (1).exe
Token: SeDebugPrivilege	5868	powershell.exe
Token: SeIncreaseQuotaPrivilege	5868	powershell.exe
Token: SeSecurityPrivilege	5868	powershell.exe
Token: SeTakeOwnershipPrivilege	5868	powershell.exe
Token: SeLoadDriverPrivilege	5868	powershell.exe
Token: SeSystemProfilePrivilege	5868	powershell.exe
Token: SeSystemtimePrivilege	5868	powershell.exe
Token: SeProfSingleProcessPrivilege	5868	powershell.exe
Token: SeIncBasePriorityPrivilege	5868	powershell.exe
Token: SeCreatePagefilePrivilege	5868	powershell.exe
Token: SeBackupPrivilege	5868	powershell.exe
Token: SeRestorePrivilege	5868	powershell.exe
Token: SeShutdownPrivilege	5868	powershell.exe
Token: SeDebugPrivilege	5868	powershell.exe
Token: SeSystemEnvironmentPrivilege	5868	powershell.exe
Token: SeRemoteShutdownPrivilege	5868	powershell.exe
Token: SeUndockPrivilege	5868	powershell.exe
Token: SeManageVolumePrivilege	5868	powershell.exe
Token: 33	5868	powershell.exe
Token: 34	5868	powershell.exe
Token: 35	5868	powershell.exe
Token: 36	5868	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeIncreaseQuotaPrivilege	216	powershell.exe
Token: SeSecurityPrivilege	216	powershell.exe
Token: SeTakeOwnershipPrivilege	216	powershell.exe
Token: SeLoadDriverPrivilege	216	powershell.exe
Token: SeSystemProfilePrivilege	216	powershell.exe
Token: SeSystemtimePrivilege	216	powershell.exe
Token: SeProfSingleProcessPrivilege	216	powershell.exe
Token: SeIncBasePriorityPrivilege	216	powershell.exe
Token: SeCreatePagefilePrivilege	216	powershell.exe
Token: SeBackupPrivilege	216	powershell.exe
Token: SeRestorePrivilege	216	powershell.exe
Token: SeShutdownPrivilege	216	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeSystemEnvironmentPrivilege	216	powershell.exe
Token: SeRemoteShutdownPrivilege	216	powershell.exe
Token: SeUndockPrivilege	216	powershell.exe
Token: SeManageVolumePrivilege	216	powershell.exe
Token: 33	216	powershell.exe
Token: 34	216	powershell.exe
Token: 35	216	powershell.exe
Token: 36	216	powershell.exe
Token: SeDebugPrivilege	2236	T_T.exe
Token: SeDebugPrivilege	2236	T_T.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2236	T_T.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 5868	1224	rc (2) (1).exe	82
PID 1224 wrote to memory of 5868	1224	rc (2) (1).exe	82
PID 1224 wrote to memory of 216	1224	rc (2) (1).exe	85
PID 1224 wrote to memory of 216	1224	rc (2) (1).exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rc (2) (1).exe
"C:\Users\Admin\AppData\Local\Temp\rc (2) (1).exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\T_T.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'T_T.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:216

C:\ProgramData\T_T.exe
"C:\ProgramData\T_T.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\T_T.exe

Filesize
227KB

MD5
3ebfd2e63dbdb727badcaee9f86c52bb

SHA1
006c520203e7610d9fed7874c803286c3b81402f

SHA256
b0c60f1512bb002f4f782c9fda6c42dded1e5f04c467d1b526205a96d602fb9f

SHA512
483eb63069156a2c5eb004a9602c9a7aa4d99ba714e5f7a7787d8af401ee5bbc5a30deb90196953a61fd61cb50584f8f9b590a9c91364bba6688248c30ca013f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
382b4ec227d59dcdc7ee931a7856a4a0

SHA1
b0be9eb255c3d3682a45504fa8a810affd277676

SHA256
1c3ed6c56135f7cc8016cf55c3a3dcd0f18e8fdda9e6c8d62ea16b2f9575905b

SHA512
23cc53edb67324e5bceedaa56bb880782e5f880ff745261d4d3bcb20e8b7d7bcf5b753da08cdcf7e43ea40edac0a1564d12b29e74a2bfb78dec941b590ee645d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5112sbhb.a1a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1224-1-0x0000000000F50000-0x0000000000F90000-memory.dmp

Filesize
256KB

Download
memory/1224-0-0x00007FF9DAE03000-0x00007FF9DAE05000-memory.dmp

Filesize
8KB

Download
memory/1224-38-0x00007FF9DAE00000-0x00007FF9DB8C2000-memory.dmp

Filesize
10.8MB

Download
memory/1224-34-0x00007FF9DAE00000-0x00007FF9DB8C2000-memory.dmp

Filesize
10.8MB

Download
memory/2236-39-0x0000000001500000-0x000000000150E000-memory.dmp

Filesize
56KB

Download
memory/5868-12-0x00007FF9DAE00000-0x00007FF9DB8C2000-memory.dmp

Filesize
10.8MB

Download
memory/5868-19-0x00007FF9DAE00000-0x00007FF9DB8C2000-memory.dmp

Filesize
10.8MB

Download
memory/5868-16-0x00007FF9DAE00000-0x00007FF9DB8C2000-memory.dmp

Filesize
10.8MB

Download
memory/5868-15-0x00007FF9DAE00000-0x00007FF9DB8C2000-memory.dmp

Filesize
10.8MB

Download
memory/5868-14-0x00007FF9DAE00000-0x00007FF9DB8C2000-memory.dmp

Filesize
10.8MB

Download
memory/5868-13-0x00007FF9DAE00000-0x00007FF9DB8C2000-memory.dmp

Filesize
10.8MB

Download
memory/5868-2-0x0000028554EF0000-0x0000028554F12000-memory.dmp

Filesize
136KB

Download