silverrat | f816bdc8ee7c6838af225701b23057a5361477bae254dab1a86bd9a253db668f

General

Target
ServersCheatersCheetah.exe
Size 42KB
Sample260409-mrr8msfv41
SHA256 f816bdc8ee7c6838af225701b23057a5361477bae254dab1a86bd9a253db668f
MD5 aaf9b3a456969b608e135af2a4794530
SHA1 2e53425689b841378abb800e09416409e4b6341b
SHA512 51cd49cd71c560ae8a9c95a273f5ab04eb264bdce6a062dc17e8452cc68d8220757b18a16a32c3828b285f3e5e1aa7ffee6a1de2c8a42f051ba124b496de7497
SSDEEP 768:9WmXbjLCPqiBuR/skdSnToj+S+BURUTXu9wUalcB6Sf2VAtP:9WmX0uI++SWUGy99PolVsP
TLSH
T1F5135C053BED813AD6BE0B7899F1424947B5F1671513EB9B1CC400EA4923BCE86827FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution silverrat persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

C2

send-mi.gl.at.ply.gg:12860

Mutex

SilverMutex_kyUHeTlTEm

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
TXhEekFZUnRqRGRkYVhUTHRuSkV1TFZRWWlrRkVh
reconnect_delay
4
server_signature
z5/N8Mdbkm06qkn1xb1TxobOUdU/nSkbBuTfIGtRu+7CEj5bmI2GtsyhtHk0UVRuIghlNFKrZaWXho7WyLEqt6GePsOt0voJM6Khj/lfpYf3tvShs9lbYKb7y/axoK/cUJk/DqUyn4MGVs9znjty0n3lODfwk0plkTn6I6cY8jEJuorbnEVtj2k53edibyyQ6VU0mLyMB2gelBkPF8y89OqsNr4b+an/KPjQMvE8rHz+8197t4M4owOJ2AiANoa9a1MKn14LBGJtsfGfX6eVI+IjNDxQ1hUPULmlQRDywwO8EX1tU31jGAXpLqFwMAxLrAl4FQJvkRsom4YM6Qs2kJSDINKair8Q1qx5IxFufgJh+aD9QECrtGgKrVjvV7NQMBH7EN9h5FzQrxmSTQSbPOQU2zCQvjSQfjmzcjThh/mBAu/427YkN6mVv1lYJMaIzUMUTFtGvG/ZHZDz9nalg5pcipv25/dKK/Z7DSjLLFMEBMdB1v9EzwrCMT5Fvf1tAokIhOYx83J5XMIz9/vxp4FdgAK3hI3xUOla5Rr5JrI04uqdSC8Q2uuec0QeUz2fc09B6WZhB7sH8JoV3Qc2jckfN2ZwP+zDNHHDgeqZ7cEj1p+QeVWUGiVc4Y5QS5mr4zVAH68/FUxfvAKbe0vNHvxF4KDAFtQ2O/hSH7WsVN4=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
60	attrib.exe
4388	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-538547578-2715485343-2034567214-1000\Control Panel\International\Geo\Nation	ServersCheatersCheetah.exe

Executes dropped EXE 3 IoCs

pid	Process
2356	$77RtkAudUService64.exe
4544	$77RtkAudUService64.exe
2456	$77RtkAudUService64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AMDNoiseSuppression\\$77RtkAudUService64.exe\""	ServersCheatersCheetah.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1976	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
3616	ServersCheatersCheetah.exe
2356	$77RtkAudUService64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	ServersCheatersCheetah.exe
Token: SeDebugPrivilege	2356	$77RtkAudUService64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2356	$77RtkAudUService64.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 60	3616	ServersCheatersCheetah.exe	85
PID 3616 wrote to memory of 4388	3616	ServersCheatersCheetah.exe	87
PID 3616 wrote to memory of 2884	3616	ServersCheatersCheetah.exe	96
PID 2884 wrote to memory of 1976	2884	cmd.exe	98
PID 2356 wrote to memory of 1804	2356	$77RtkAudUService64.exe	101
PID 2356 wrote to memory of 216	2356	$77RtkAudUService64.exe	103
PID 2356 wrote to memory of 4024	2356	$77RtkAudUService64.exe	105
PID 2884 wrote to memory of 2456	2884	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
60	attrib.exe
4388	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ServersCheatersCheetah.exe
"C:\Users\Admin\AppData\Local\Temp\ServersCheatersCheetah.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AMDNoiseSuppression"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:60
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6656.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1976
- - C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
    "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
    3⤵
    - Executes dropped EXE
    PID:2456

C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
"C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /TN $77RtkAudUService64.exe
  2⤵
  PID:1804
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /SC ONCE /TN "$77RtkAudUService64.exe" /TR "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe \"\$77RtkAudUService64.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:216
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /TN $77RtkAudUService64.exe
  2⤵
  PID:4024

C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
1⤵
- Executes dropped EXE
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$77RtkAudUService64.exe

Path C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
Size 42KB
SHA256 f816bdc8ee7c6838af225701b23057a5361477bae254dab1a86bd9a253db668f
MD5 aaf9b3a456969b608e135af2a4794530
SHA1 2e53425689b841378abb800e09416409e4b6341b
SHA512 51cd49cd71c560ae8a9c95a273f5ab04eb264bdce6a062dc17e8452cc68d8220757b18a16a32c3828b285f3e5e1aa7ffee6a1de2c8a42f051ba124b496de7497
SSDEEP 768:9WmXbjLCPqiBuR/skdSnToj+S+BURUTXu9wUalcB6Sf2VAtP:9WmX0uI++SWUGy99PolVsP
TLSH
T1F5135C053BED813AD6BE0B7899F1424947B5F1671513EB9B1CC400EA4923BCE86827FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$77RtkAudUService64.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77RtkAudUService64.exe.log
Size 425B
SHA256 b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
MD5 fff5cbccb6b31b40f834b8f4778a779a
SHA1 899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA512 1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9
TLSH
T15CE0AB702261E2D449023F54280D2A8443BF4729A620DE083494629FD8311230F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

tmp6656.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6656.tmp.bat
Size 167B
SHA256 223a8e3757decd43dbb3a49bcb90f8e593739548ecdefb2a7544419903d4de2c
MD5 43b46cd7103243a2f690149054d5e38c
SHA1 7c273176cfb0da7528f8183fd33f553ed614a9f5
SHA512 9d82361b76914acdc47f966a6790294511c535114c4192eeb05af2865c8e9423d2811fc2aac14b22de92d53010d5336cae92f042cc09969284d8ebe0ba3c46d4
TLSH
T130C08052F8C55D5A240454130177994CA1F7291D3E40F7A0438556152680C8DD49D242
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3616-0-0x0000000000860000-0x000000000086E000-memory.dmp

Download

memory/3616-1-0x00000000011A0000-0x00000000011B0000-memory.dmp

Download

memory/3616-3-0x00000000011A0000-0x00000000011B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads