silverrat | f816bdc8ee7c6838af225701b23057a5361477bae254dab1a86bd9a253db668f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/04/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Servers Cheaters Cheetah.exe
Size 42KB
Sample260409-mfnfbae17v
SHA256 f816bdc8ee7c6838af225701b23057a5361477bae254dab1a86bd9a253db668f
MD5 aaf9b3a456969b608e135af2a4794530
SHA1 2e53425689b841378abb800e09416409e4b6341b
SHA512 51cd49cd71c560ae8a9c95a273f5ab04eb264bdce6a062dc17e8452cc68d8220757b18a16a32c3828b285f3e5e1aa7ffee6a1de2c8a42f051ba124b496de7497
SSDEEP 768:9WmXbjLCPqiBuR/skdSnToj+S+BURUTXu9wUalcB6Sf2VAtP:9WmX0uI++SWUGy99PolVsP
TLSH
T1F5135C053BED813AD6BE0B7899F1424947B5F1671513EB9B1CC400EA4923BCE86827FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution silverrat persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

send-mi.gl.at.ply.gg:12860

Mutex

SilverMutex_kyUHeTlTEm

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
TXhEekFZUnRqRGRkYVhUTHRuSkV1TFZRWWlrRkVh
reconnect_delay
4
server_signature
z5/N8Mdbkm06qkn1xb1TxobOUdU/nSkbBuTfIGtRu+7CEj5bmI2GtsyhtHk0UVRuIghlNFKrZaWXho7WyLEqt6GePsOt0voJM6Khj/lfpYf3tvShs9lbYKb7y/axoK/cUJk/DqUyn4MGVs9znjty0n3lODfwk0plkTn6I6cY8jEJuorbnEVtj2k53edibyyQ6VU0mLyMB2gelBkPF8y89OqsNr4b+an/KPjQMvE8rHz+8197t4M4owOJ2AiANoa9a1MKn14LBGJtsfGfX6eVI+IjNDxQ1hUPULmlQRDywwO8EX1tU31jGAXpLqFwMAxLrAl4FQJvkRsom4YM6Qs2kJSDINKair8Q1qx5IxFufgJh+aD9QECrtGgKrVjvV7NQMBH7EN9h5FzQrxmSTQSbPOQU2zCQvjSQfjmzcjThh/mBAu/427YkN6mVv1lYJMaIzUMUTFtGvG/ZHZDz9nalg5pcipv25/dKK/Z7DSjLLFMEBMdB1v9EzwrCMT5Fvf1tAokIhOYx83J5XMIz9/vxp4FdgAK3hI3xUOla5Rr5JrI04uqdSC8Q2uuec0QeUz2fc09B6WZhB7sH8JoV3Qc2jckfN2ZwP+zDNHHDgeqZ7cEj1p+QeVWUGiVc4Y5QS5mr4zVAH68/FUxfvAKbe0vNHvxF4KDAFtQ2O/hSH7WsVN4=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4916	attrib.exe
5420	attrib.exe

Executes dropped EXE 3 IoCs

pid	Process
5792	$77RtkAudUService64.exe
5224	$77RtkAudUService64.exe
3048	$77RtkAudUService64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AMDNoiseSuppression\\$77RtkAudUService64.exe\""	Servers Cheaters Cheetah.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1040	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
492	Servers Cheaters Cheetah.exe
5792	$77RtkAudUService64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	492	Servers Cheaters Cheetah.exe
Token: SeDebugPrivilege	5792	$77RtkAudUService64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5792	$77RtkAudUService64.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 4916	492	Servers Cheaters Cheetah.exe	79
PID 492 wrote to memory of 5420	492	Servers Cheaters Cheetah.exe	81
PID 492 wrote to memory of 3064	492	Servers Cheaters Cheetah.exe	83
PID 3064 wrote to memory of 1040	3064	cmd.exe	85
PID 5792 wrote to memory of 2160	5792	$77RtkAudUService64.exe	88
PID 5792 wrote to memory of 1080	5792	$77RtkAudUService64.exe	90
PID 5792 wrote to memory of 2508	5792	$77RtkAudUService64.exe	92
PID 3064 wrote to memory of 3048	3064	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4916	attrib.exe
5420	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Servers Cheaters Cheetah.exe
"C:\Users\Admin\AppData\Local\Temp\Servers Cheaters Cheetah.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AMDNoiseSuppression"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4916
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp64EF.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1040
- - C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
    "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
    3⤵
    - Executes dropped EXE
    PID:3048

C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
"C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /TN $77RtkAudUService64.exe
  2⤵
  PID:2160
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /SC ONCE /TN "$77RtkAudUService64.exe" /TR "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe \"\$77RtkAudUService64.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1080
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /TN $77RtkAudUService64.exe
  2⤵
  PID:2508

C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
1⤵
- Executes dropped EXE
PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$77RtkAudUService64.exe

Path C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
Size 42KB
SHA256 f816bdc8ee7c6838af225701b23057a5361477bae254dab1a86bd9a253db668f
MD5 aaf9b3a456969b608e135af2a4794530
SHA1 2e53425689b841378abb800e09416409e4b6341b
SHA512 51cd49cd71c560ae8a9c95a273f5ab04eb264bdce6a062dc17e8452cc68d8220757b18a16a32c3828b285f3e5e1aa7ffee6a1de2c8a42f051ba124b496de7497
SSDEEP 768:9WmXbjLCPqiBuR/skdSnToj+S+BURUTXu9wUalcB6Sf2VAtP:9WmX0uI++SWUGy99PolVsP
TLSH
T1F5135C053BED813AD6BE0B7899F1424947B5F1671513EB9B1CC400EA4923BCE86827FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$77RtkAudUService64.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77RtkAudUService64.exe.log
Size 425B
SHA256 d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140
MD5 de75c43a265d0848584ae05945570edf
SHA1 69f95177914f8d8b2f278a91f585a0024b8dffd3
SHA512 365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc
TLSH
T1EFE0683133A1A1D988573F83295C678D53BF43196650FE08B994225ED82902B6F313E3
MD5 SHA1 SHA512 TLSH

Submit Download

tmp64EF.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp64EF.tmp.bat
Size 167B
SHA256 fa535a1af1de6c559a26c2b6bf101e5c6d6419211652b2a6039c86d7c6eabfa3
MD5 89d283a1b8c4d57bbfcd7136f52e87d2
SHA1 33f1dee4e98bf6c0ae16f7712a24bca9e7009d06
SHA512 75fd4aa1488d26f70c9bbec8e3ef94c1d9604eee9a133abf6ac8accd718392a541474ab1e9754dbd3f981c45696955e9c0082530917cbfa6ff5b54bac54a01ae
TLSH
T13DC08052F4C55F5A154454170177955CA1F7291D3E40B760438555551680D8DD499242
MD5 SHA1 SHA512 TLSH

Submit Download

memory/492-0-0x00000000000E0000-0x00000000000EE000-memory.dmp

Download

memory/492-1-0x0000000000B20000-0x0000000000B30000-memory.dmp

Download

memory/492-3-0x0000000000B00000-0x0000000000B0C000-memory.dmp

Download

memory/492-4-0x0000000000B20000-0x0000000000B30000-memory.dmp

Download

memory/492-9-0x0000000000B00000-0x0000000000B0C000-memory.dmp

Download

memory/3048-17-0x00000000011B0000-0x00000000011BC000-memory.dmp

Download

memory/5224-14-0x00000000018D0000-0x00000000018DC000-memory.dmp

Download

memory/5792-18-0x00000000017C0000-0x00000000017CC000-memory.dmp

Download