silverrat | d05f5a9bcb125697209fbcf59531c6781293723880d7d490075b1e296b3ede5e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/04/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Servers Cheaters Cheetah.exe
Size 42KB
Sample260409-mf5plae18t
SHA256 d05f5a9bcb125697209fbcf59531c6781293723880d7d490075b1e296b3ede5e
MD5 a26f0882c277f435a1e86c5c8a7e04dd
SHA1 653bb3603bb434413d6a9f0a39b5afed6b4b57f5
SHA512 b5e38246406b13927b8414a40271be1a0c427e383165849d963bf9d3aa2e682ee3a74dd9b8f950dafc3c5af6774fffbce1a784f25f797afdfc1281f6cc8982cd
SSDEEP 768:ytX7YwP/6iBu5/pkdSnToj+S+BkRUTXt9wUalcB6STdVAtP:ytXju5++SWkGx99Po6VsP
TLSH
T1D4135C052BED813AD6BE0B7899F1425946B4F1671513EB9F1CC400EB5923BCE87827FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution silverrat persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

144.31.237.190:1498

Mutex

SilverMutex_kyUHeTlTEm

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
TXhEekFZUnRqRGRkYVhUTHRuSkV1TFZRWWlrRkVh
reconnect_delay
4
server_signature
z5/N8Mdbkm06qkn1xb1TxobOUdU/nSkbBuTfIGtRu+7CEj5bmI2GtsyhtHk0UVRuIghlNFKrZaWXho7WyLEqt6GePsOt0voJM6Khj/lfpYf3tvShs9lbYKb7y/axoK/cUJk/DqUyn4MGVs9znjty0n3lODfwk0plkTn6I6cY8jEJuorbnEVtj2k53edibyyQ6VU0mLyMB2gelBkPF8y89OqsNr4b+an/KPjQMvE8rHz+8197t4M4owOJ2AiANoa9a1MKn14LBGJtsfGfX6eVI+IjNDxQ1hUPULmlQRDywwO8EX1tU31jGAXpLqFwMAxLrAl4FQJvkRsom4YM6Qs2kJSDINKair8Q1qx5IxFufgJh+aD9QECrtGgKrVjvV7NQMBH7EN9h5FzQrxmSTQSbPOQU2zCQvjSQfjmzcjThh/mBAu/427YkN6mVv1lYJMaIzUMUTFtGvG/ZHZDz9nalg5pcipv25/dKK/Z7DSjLLFMEBMdB1v9EzwrCMT5Fvf1tAokIhOYx83J5XMIz9/vxp4FdgAK3hI3xUOla5Rr5JrI04uqdSC8Q2uuec0QeUz2fc09B6WZhB7sH8JoV3Qc2jckfN2ZwP+zDNHHDgeqZ7cEj1p+QeVWUGiVc4Y5QS5mr4zVAH68/FUxfvAKbe0vNHvxF4KDAFtQ2O/hSH7WsVN4=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1400	attrib.exe
2940	attrib.exe

Executes dropped EXE 3 IoCs

pid	Process
1536	$77RtkAudUService64.exe
4808	$77RtkAudUService64.exe
3788	$77RtkAudUService64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AMDNoiseSuppression\\$77RtkAudUService64.exe\""	Servers Cheaters Cheetah.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4184	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
3432	Servers Cheaters Cheetah.exe
1536	$77RtkAudUService64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	Servers Cheaters Cheetah.exe
Token: SeDebugPrivilege	1536	$77RtkAudUService64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1536	$77RtkAudUService64.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 1400	3432	Servers Cheaters Cheetah.exe	79
PID 3432 wrote to memory of 2940	3432	Servers Cheaters Cheetah.exe	81
PID 3432 wrote to memory of 1440	3432	Servers Cheaters Cheetah.exe	83
PID 1440 wrote to memory of 4184	1440	cmd.exe	85
PID 1536 wrote to memory of 1704	1536	$77RtkAudUService64.exe	88
PID 1536 wrote to memory of 3160	1536	$77RtkAudUService64.exe	90
PID 1536 wrote to memory of 2720	1536	$77RtkAudUService64.exe	92
PID 1440 wrote to memory of 3788	1440	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1400	attrib.exe
2940	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Servers Cheaters Cheetah.exe
"C:\Users\Admin\AppData\Local\Temp\Servers Cheaters Cheetah.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AMDNoiseSuppression"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1400
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2C6A.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4184
- - C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
    "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
    3⤵
    - Executes dropped EXE
    PID:3788

C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
"C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /TN $77RtkAudUService64.exe
  2⤵
  PID:1704
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /SC ONCE /TN "$77RtkAudUService64.exe" /TR "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe \"\$77RtkAudUService64.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3160
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /TN $77RtkAudUService64.exe
  2⤵
  PID:2720

C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
1⤵
- Executes dropped EXE
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$77RtkAudUService64.exe

Path C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
Size 42KB
SHA256 d05f5a9bcb125697209fbcf59531c6781293723880d7d490075b1e296b3ede5e
MD5 a26f0882c277f435a1e86c5c8a7e04dd
SHA1 653bb3603bb434413d6a9f0a39b5afed6b4b57f5
SHA512 b5e38246406b13927b8414a40271be1a0c427e383165849d963bf9d3aa2e682ee3a74dd9b8f950dafc3c5af6774fffbce1a784f25f797afdfc1281f6cc8982cd
SSDEEP 768:ytX7YwP/6iBu5/pkdSnToj+S+BkRUTXt9wUalcB6STdVAtP:ytXju5++SWkGx99Po6VsP
TLSH
T1D4135C052BED813AD6BE0B7899F1425946B4F1671513EB9F1CC400EB5923BCE87827FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$77RtkAudUService64.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77RtkAudUService64.exe.log
Size 425B
SHA256 d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140
MD5 de75c43a265d0848584ae05945570edf
SHA1 69f95177914f8d8b2f278a91f585a0024b8dffd3
SHA512 365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc
TLSH
T1EFE0683133A1A1D988573F83295C678D53BF43196650FE08B994225ED82902B6F313E3
MD5 SHA1 SHA512 TLSH

Submit Download

tmp2C6A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp2C6A.tmp.bat
Size 167B
SHA256 aed643f3611029f6cd77dc9361a5103e599e7501fa8f04225e2f7e91c584cdb6
MD5 70d98e2768212695d1ccfc948f67d9fb
SHA1 6bfd69b29f56f9f64b30dab738dfa23c7017bef9
SHA512 6b06c168e78755270348319a2797f62bee73609202e8a2e05c96eb14a7c71fc47652c70ea039355cefff0543bc6830f73d5b8289973d1d150ab2a73bf2ae30b2
TLSH
T171C08052F4C55DAA250454130177D44CB1F7291D3E40B760438555152680CCDD499242
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1536-18-0x00000000016B0000-0x00000000016BC000-memory.dmp

Download

memory/1536-22-0x000000001E500000-0x000000001E510000-memory.dmp

Download

memory/3432-0-0x00000000007A0000-0x00000000007AE000-memory.dmp

Download

memory/3432-1-0x0000000003250000-0x0000000003260000-memory.dmp

Download

memory/3432-3-0x00000000011D0000-0x00000000011DC000-memory.dmp

Download

memory/3432-4-0x0000000003250000-0x0000000003260000-memory.dmp

Download

memory/3432-9-0x00000000011D0000-0x00000000011DC000-memory.dmp

Download

memory/3788-17-0x00000000018D0000-0x00000000018DC000-memory.dmp

Download

memory/4808-14-0x0000000001190000-0x000000000119C000-memory.dmp

Download