silverrat | 769b2096c5e801845d1ed7d738ddab14a87afaf21d074ff29fe4cdbbcdd3b447

Analysis

max time kernel
101s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RuntimeBroker.exe
Size

43KB
MD5

a05372ded01cb9c4c59ebde5f3e688f3
SHA1

f4950fc4cf6470afdeeb19bdba551445f2046bc9
SHA256

769b2096c5e801845d1ed7d738ddab14a87afaf21d074ff29fe4cdbbcdd3b447
SHA512

3ef7823a3d230fbfd7b003fc417c5bceac840ff889f75e47b24cb0695cf79999807f2948cdfc3ad6db2a0eb85a3e739814f7d596bfd1fdaf7c92e7edf68d0bf7
SSDEEP

768:5FoacjSeq8F9/Ol6IoZmkPH5m79WwIf9+ou0BRULQW9PrGSz1QB6S5/l/:5F/cjSetatyBm8HkEBGsW9a+1Qoe/l/

Score

10^/10

silverrat defense_evasion execution persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

if-eventually.gl.at.ply.gg:17094

Mutex

lAxDBRhAFu

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
reconnect_delay
43
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5024	attrib.exe
1468	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	$77RuntimeBroker.exe

Executes dropped EXE 2 IoCs

pid	Process
3860	$77RuntimeBroker.exe
4392	$77RuntimeBroker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\SysTask\\$77RuntimeBroker.exe\""	RuntimeBroker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3996	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4464	timeout.exe
5020	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
916	schtasks.exe
1936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
1644	RuntimeBroker.exe
3860	$77RuntimeBroker.exe
3860	$77RuntimeBroker.exe
3996	powershell.exe
3996	powershell.exe
3996	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	3692	vssvc.exe
Token: SeRestorePrivilege	3692	vssvc.exe
Token: SeAuditPrivilege	3692	vssvc.exe
Token: SeDebugPrivilege	1644	RuntimeBroker.exe
Token: SeDebugPrivilege	3860	$77RuntimeBroker.exe
Token: SeDebugPrivilege	3996	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3860	$77RuntimeBroker.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 5024	1644	RuntimeBroker.exe	93
PID 1644 wrote to memory of 5024	1644	RuntimeBroker.exe	93
PID 1644 wrote to memory of 1468	1644	RuntimeBroker.exe	95
PID 1644 wrote to memory of 1468	1644	RuntimeBroker.exe	95
PID 1644 wrote to memory of 5096	1644	RuntimeBroker.exe	109
PID 1644 wrote to memory of 5096	1644	RuntimeBroker.exe	109
PID 5096 wrote to memory of 4464	5096	cmd.exe	113
PID 5096 wrote to memory of 4464	5096	cmd.exe	113
PID 2964 wrote to memory of 3860	2964	cmd.exe	114
PID 2964 wrote to memory of 3860	2964	cmd.exe	114
PID 3860 wrote to memory of 2316	3860	$77RuntimeBroker.exe	116
PID 3860 wrote to memory of 2316	3860	$77RuntimeBroker.exe	116
PID 3860 wrote to memory of 916	3860	$77RuntimeBroker.exe	118
PID 3860 wrote to memory of 916	3860	$77RuntimeBroker.exe	118
PID 3860 wrote to memory of 2132	3860	$77RuntimeBroker.exe	120
PID 3860 wrote to memory of 2132	3860	$77RuntimeBroker.exe	120
PID 3860 wrote to memory of 3996	3860	$77RuntimeBroker.exe	122
PID 3860 wrote to memory of 3996	3860	$77RuntimeBroker.exe	122
PID 3860 wrote to memory of 1936	3860	$77RuntimeBroker.exe	123
PID 3860 wrote to memory of 1936	3860	$77RuntimeBroker.exe	123
PID 5096 wrote to memory of 4392	5096	cmd.exe	126
PID 5096 wrote to memory of 4392	5096	cmd.exe	126
PID 3860 wrote to memory of 1524	3860	$77RuntimeBroker.exe	136
PID 3860 wrote to memory of 1524	3860	$77RuntimeBroker.exe	136
PID 3860 wrote to memory of 4392	3860	$77RuntimeBroker.exe	138
PID 3860 wrote to memory of 4392	3860	$77RuntimeBroker.exe	138
PID 1524 wrote to memory of 4348	1524	cmd.exe	140
PID 1524 wrote to memory of 4348	1524	cmd.exe	140
PID 4392 wrote to memory of 5020	4392	cmd.exe	141
PID 4392 wrote to memory of 5020	4392	cmd.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5024	attrib.exe
1468	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SysTask"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5024
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SysTask\$77RuntimeBroker.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCC78.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4464
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SysTask\$77RuntimeBroker.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SysTask\$77RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    PID:4392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SysTask\$77RuntimeBroker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SysTask\$77RuntimeBroker.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SysTask\$77RuntimeBroker.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /TN $77RuntimeBroker.exe
    3⤵
    PID:2316
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Create /SC ONCE /TN "$77RuntimeBroker.exe" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SysTask\$77RuntimeBroker.exe \"\$77RuntimeBroker.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:916
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /query /TN $77RuntimeBroker.exe
    3⤵
    PID:2132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "RuntimeBroker_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1936
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "$77RuntimeBroker_Task"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /f /tn "$77RuntimeBroker_Task"
      4⤵
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA7D4.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77RuntimeBroker.exe.log

Filesize
859B

MD5
e204f3d12abd1691ce1f149399441188

SHA1
798042095539abfe857e456fca4e1035f67d29bf

SHA256
685f70bf685f654651dcd0acc495b6f52f02f73cc3ca8b3d2c8433aac9ba144d

SHA512
804c5ea57a59f86fd0c34479be4c479230bff79093548e8461758829928969da565c211ccc9cb9befa0fef15f0400a5b1f17d5ddf88aef6ff01b67a191176b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m01g3lkx.13v.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA7D4.tmp.bat

Filesize
316B

MD5
7cac43213e23c0f1be01c80411abf46b

SHA1
549e8b2506844cbc9f27fde87c997f2984c5cc7d

SHA256
5c6d3985517e3e3bc1aff64124ca563ca7f5151e581f8fe10603b941165f8463

SHA512
0b8239878f03a2320107d07d0ef7c551cdb540361c8665eed0ebc1d5b2e6f87b26b2dadf719be90890eb990acfe977de0a2d802d8503bfc0e1134519c5c7291f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCC78.tmp.bat

Filesize
196B

MD5
56a7d2e874b2b520eabd19fed9a158f1

SHA1
628e8b70a697987fa0ec6473b02ac1eed143e31f

SHA256
e49305ffcf2db4b310cc36b2c43525120f039da0809b1914f5a64b8faa7553fc

SHA512
2091ca19c1c70579603c4c758d649539c5658329355fa360fa073305bb32c4ec7f8f34534336747def69c3d89206466a6144c4088bda5faef5aac3ae3e2ad10b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\SysTask\$77RuntimeBroker.exe

Filesize
43KB

MD5
a05372ded01cb9c4c59ebde5f3e688f3

SHA1
f4950fc4cf6470afdeeb19bdba551445f2046bc9

SHA256
769b2096c5e801845d1ed7d738ddab14a87afaf21d074ff29fe4cdbbcdd3b447

SHA512
3ef7823a3d230fbfd7b003fc417c5bceac840ff889f75e47b24cb0695cf79999807f2948cdfc3ad6db2a0eb85a3e739814f7d596bfd1fdaf7c92e7edf68d0bf7

Download Submit
memory/1644-1-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download
memory/1644-0-0x00007FFE911A3000-0x00007FFE911A5000-memory.dmp

Filesize
8KB

Download
memory/1644-2-0x00007FFE911A3000-0x00007FFE911A5000-memory.dmp

Filesize
8KB

Download
memory/3860-27-0x000000001FF10000-0x000000001FF30000-memory.dmp

Filesize
128KB

Download
memory/3996-16-0x000001A7C5320000-0x000001A7C5342000-memory.dmp

Filesize
136KB

Download