33c86ecfc324de3af97150bd009aba7925a6ba7a0842e127e94cf351013c0fe6

Analysis

max time kernel
149s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
30/11/2025, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
silke.exe
Size 77.9MB
Sample251130-prx51ahp21
SHA256 33c86ecfc324de3af97150bd009aba7925a6ba7a0842e127e94cf351013c0fe6
MD5 9a4970cf9af1e0d83063c43030b3d2a4
SHA1 e89c7096f1ff36d5674aa70ac82fc7797ffe9d99
SHA512 3122eb316e09a30a74b4b4dfe6209669ddc5fdd2e348aee97aeec9984e0819da5f2bb7c90b39ae03d734a4737e7601b6b370a864b1aaa757932cc7135e647d64
SSDEEP 98304:vM8FuCYsdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdzaG+sdl:rFz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2564	silke.exe
4468	silke.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	silke.exe
File opened (read-only)	\??\F:	silke.exe
File opened (read-only)	\??\F:	silke.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1000	silke.exe
4468	silke.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1000	silke.exe
1000	silke.exe
1000	silke.exe
2564	silke.exe
2564	silke.exe
2564	silke.exe
4468	silke.exe
4468	silke.exe
4468	silke.exe
4468	silke.exe
4468	silke.exe
4468	silke.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 4468	1000	silke.exe	81
PID 1000 wrote to memory of 4468	1000	silke.exe	81

C:\Users\Admin\AppData\Local\Temp\silke.exe
"C:\Users\Admin\AppData\Local\Temp\silke.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Roaming\silke\silke.exe
  "C:\Users\Admin\AppData\Roaming\silke\silke.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  PID:4468

C:\Users\Admin\AppData\Roaming\silke\silke.exe
C:\Users\Admin\AppData\Roaming\silke\silke.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

silke.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\silke.lnk
Size 583B
SHA256 f364dcb70ba8373f0f762f2c3fa2483e18bab6384a07999390dec3c5f044625c
MD5 9f25eb6c5399759c212cf38f71a0a4e1
SHA1 42d223b1d955d5edfde68ff34c3636192bfc42be
SHA512 8c576561b8651c120431cb9cd66961c2bee33b91cd0d2fad0d94cddf6478aee9313e51f9a72378cfce169d3206d03ff6e467c84c48e1cba2e3b25951918189e8
MD5 SHA1 SHA512

Submit Download