silverrat | ae271c063cf48fd0b74cb34e221265e5f35567b05ee0401ff577c22e8c6a5cc6

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20251231-en
resource tags

arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
submitted
07/01/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-01-07_60b8e07fbda5fd6f82033e9a76d44391_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 915KB
Sample260107-deqplsel4t
SHA256 ae271c063cf48fd0b74cb34e221265e5f35567b05ee0401ff577c22e8c6a5cc6
MD5 60b8e07fbda5fd6f82033e9a76d44391
SHA1 a5a546b95243637195fa8df520145415c691caff
SHA512 e2e090c8759985725bce0808151e7ed40882c62a0878b1d960500e8223029609bec2f4160b4c8af6a479a7384e5df1a6c29d8f4e161d15aec2684f1edac6b75f
SSDEEP 12288:dhoVY2+LfWvRSECKG4iRkTFC+nlr4S1tC+nlr4S1b+fL1ZJxB2JpHufawwtK:zb2+CvRSEHiRkTfnXnA1lwJpHuf4K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion execution silverrat persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

127.0.0.1:8080

Mutex

SilverMutex_cEgOnKPTTX

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
reconnect_delay
4
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Executes dropped EXE 2 IoCs

pid	Process
2260	hyper.exe
5056	Google Chrome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5672	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3912	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1056	schtasks.exe
5992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
2260	hyper.exe
5056	Google Chrome.exe
5672	powershell.exe
5672	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	hyper.exe
Token: SeDebugPrivilege	5056	Google Chrome.exe
Token: SeDebugPrivilege	5672	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5056	Google Chrome.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2260	4696	2026-01-07_60b8e07fbda5fd6f82033e9a76d44391_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	77
PID 2260 wrote to memory of 5532	2260	hyper.exe	78
PID 5532 wrote to memory of 3912	5532	cmd.exe	80
PID 5532 wrote to memory of 5056	5532	cmd.exe	81
PID 5056 wrote to memory of 4860	5056	Google Chrome.exe	82
PID 5056 wrote to memory of 1056	5056	Google Chrome.exe	84
PID 5056 wrote to memory of 5796	5056	Google Chrome.exe	86
PID 5056 wrote to memory of 5672	5056	Google Chrome.exe	88
PID 5056 wrote to memory of 5992	5056	Google Chrome.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-01-07_60b8e07fbda5fd6f82033e9a76d44391_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-01-07_60b8e07fbda5fd6f82033e9a76d44391_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\hyper.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\hyper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAC1E.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:3912
  - - C:\Users\Admin\AppData\Roaming\Google Chrome\Google Chrome.exe
      "C:\Users\Admin\AppData\Roaming\Google Chrome\Google Chrome.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /query /TN Google Chrome.exe
        5⤵
        
        PID:4860
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /Create /SC ONCE /TN "Google Chrome.exe" /TR "C:\Users\Admin\AppData\Roaming\Google Chrome\Google Chrome.exe \"\Google Chrome.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1056
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /query /TN Google Chrome.exe
        5⤵
        
        PID:5796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5672
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "Google Chrome_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyper.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hyper.exe
Size 40KB
SHA256 20982168f3f1626e781c3e5acda5e52359f3966784126c89fd39358097de3170
MD5 eff485fa9de0cd0823a4c2b0e939fba5
SHA1 fb92ba6b11cfc5c45fdad92ea392ce98a8df0d05
SHA512 be6c1c8369e3072761fe06377aa2cff7beab284a22696bed8962eb30b45396f41919f7a6d9764eccc5ac4ae98c2371cfca20003083de262d2bbc40604e73609a
SSDEEP 768:0F4h8E+YkFBTTtPS5ZavbkmidNz6XN9Gwozbz6ARUU90GWz1QB6SyasU0f5:0FA8RqIkmid+8wSfGU9Fa1Qo1asU0f5
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ugo3g1to.tfu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ugo3g1to.tfu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpAC1E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpAC1E.tmp.bat
Size 171B
SHA256 c3ebf7c565dab4e14c8b6a131532866a8e2d553da6e6183d67f76fe38a8f2e27
MD5 efb42897beffb6d0e6f381c910bb78fc
SHA1 dce201577588550a5be380c93d03237348abf372
SHA512 9accf0382d883b6a113b76cc7afa49e68e3c30e95c7fe3ecd1c59bad51330e635f0f515b5eff18fd6da36088385abc706bf96d2deb3014581a8ed0d27cc1b5f1
MD5 SHA1 SHA512

Submit Download

memory/2260-14-0x00000000003E0000-0x00000000003EE000-memory.dmp

Download

memory/2260-15-0x00000000012D0000-0x00000000012E0000-memory.dmp

Download

memory/5672-37-0x000001EA4A720000-0x000001EA4A73C000-memory.dmp

Download

memory/5672-29-0x000001EA30A80000-0x000001EA30AA2000-memory.dmp

Download

memory/5672-38-0x000001EA4A9F0000-0x000001EA4AAA3000-memory.dmp

Download

memory/5672-39-0x000001EA4A750000-0x000001EA4A75A000-memory.dmp

Download

memory/5672-40-0x000001EA4A780000-0x000001EA4A79C000-memory.dmp

Download

memory/5672-41-0x000001EA4A760000-0x000001EA4A76A000-memory.dmp

Download

memory/5672-42-0x000001EA4A7C0000-0x000001EA4A7DA000-memory.dmp

Download

memory/5672-43-0x000001EA4A770000-0x000001EA4A778000-memory.dmp

Download

memory/5672-44-0x000001EA4A7A0000-0x000001EA4A7A6000-memory.dmp

Download

memory/5672-45-0x000001EA4A7B0000-0x000001EA4A7BA000-memory.dmp

Download