silverrat | f816bdc8ee7c6838af225701b23057a5361477bae254dab1a86bd9a253db668f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/04/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ServersCheatersCheetah.exe
Size 42KB
Sample260409-mrr8msfv41
SHA256 f816bdc8ee7c6838af225701b23057a5361477bae254dab1a86bd9a253db668f
MD5 aaf9b3a456969b608e135af2a4794530
SHA1 2e53425689b841378abb800e09416409e4b6341b
SHA512 51cd49cd71c560ae8a9c95a273f5ab04eb264bdce6a062dc17e8452cc68d8220757b18a16a32c3828b285f3e5e1aa7ffee6a1de2c8a42f051ba124b496de7497
SSDEEP 768:9WmXbjLCPqiBuR/skdSnToj+S+BURUTXu9wUalcB6Sf2VAtP:9WmX0uI++SWUGy99PolVsP
TLSH
T1F5135C053BED813AD6BE0B7899F1424947B5F1671513EB9B1CC400EA4923BCE86827FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution silverrat persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

send-mi.gl.at.ply.gg:12860

Mutex

SilverMutex_kyUHeTlTEm

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
TXhEekFZUnRqRGRkYVhUTHRuSkV1TFZRWWlrRkVh
reconnect_delay
4
server_signature
z5/N8Mdbkm06qkn1xb1TxobOUdU/nSkbBuTfIGtRu+7CEj5bmI2GtsyhtHk0UVRuIghlNFKrZaWXho7WyLEqt6GePsOt0voJM6Khj/lfpYf3tvShs9lbYKb7y/axoK/cUJk/DqUyn4MGVs9znjty0n3lODfwk0plkTn6I6cY8jEJuorbnEVtj2k53edibyyQ6VU0mLyMB2gelBkPF8y89OqsNr4b+an/KPjQMvE8rHz+8197t4M4owOJ2AiANoa9a1MKn14LBGJtsfGfX6eVI+IjNDxQ1hUPULmlQRDywwO8EX1tU31jGAXpLqFwMAxLrAl4FQJvkRsom4YM6Qs2kJSDINKair8Q1qx5IxFufgJh+aD9QECrtGgKrVjvV7NQMBH7EN9h5FzQrxmSTQSbPOQU2zCQvjSQfjmzcjThh/mBAu/427YkN6mVv1lYJMaIzUMUTFtGvG/ZHZDz9nalg5pcipv25/dKK/Z7DSjLLFMEBMdB1v9EzwrCMT5Fvf1tAokIhOYx83J5XMIz9/vxp4FdgAK3hI3xUOla5Rr5JrI04uqdSC8Q2uuec0QeUz2fc09B6WZhB7sH8JoV3Qc2jckfN2ZwP+zDNHHDgeqZ7cEj1p+QeVWUGiVc4Y5QS5mr4zVAH68/FUxfvAKbe0vNHvxF4KDAFtQ2O/hSH7WsVN4=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3116	attrib.exe
2176	attrib.exe

Executes dropped EXE 3 IoCs

pid	Process
2208	$77RtkAudUService64.exe
2896	$77RtkAudUService64.exe
4668	$77RtkAudUService64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AMDNoiseSuppression\\$77RtkAudUService64.exe\""	ServersCheatersCheetah.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2540	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
4660	ServersCheatersCheetah.exe
2208	$77RtkAudUService64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	ServersCheatersCheetah.exe
Token: SeDebugPrivilege	2208	$77RtkAudUService64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2208	$77RtkAudUService64.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3116	4660	ServersCheatersCheetah.exe	79
PID 4660 wrote to memory of 2176	4660	ServersCheatersCheetah.exe	81
PID 4660 wrote to memory of 3800	4660	ServersCheatersCheetah.exe	83
PID 3800 wrote to memory of 2540	3800	cmd.exe	85
PID 2208 wrote to memory of 2524	2208	$77RtkAudUService64.exe	88
PID 2208 wrote to memory of 2108	2208	$77RtkAudUService64.exe	90
PID 2208 wrote to memory of 5084	2208	$77RtkAudUService64.exe	92
PID 3800 wrote to memory of 4668	3800	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2176	attrib.exe
3116	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ServersCheatersCheetah.exe
"C:\Users\Admin\AppData\Local\Temp\ServersCheatersCheetah.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AMDNoiseSuppression"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3116
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp28A1.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2540
- - C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
    "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
    3⤵
    - Executes dropped EXE
    PID:4668

C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
"C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /TN $77RtkAudUService64.exe
  2⤵
  PID:2524
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /SC ONCE /TN "$77RtkAudUService64.exe" /TR "C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe \"\$77RtkAudUService64.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2108
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /query /TN $77RtkAudUService64.exe
  2⤵
  PID:5084

C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
1⤵
- Executes dropped EXE
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$77RtkAudUService64.exe

Path C:\Users\Admin\AMDNoiseSuppression\$77RtkAudUService64.exe
Size 42KB
SHA256 f816bdc8ee7c6838af225701b23057a5361477bae254dab1a86bd9a253db668f
MD5 aaf9b3a456969b608e135af2a4794530
SHA1 2e53425689b841378abb800e09416409e4b6341b
SHA512 51cd49cd71c560ae8a9c95a273f5ab04eb264bdce6a062dc17e8452cc68d8220757b18a16a32c3828b285f3e5e1aa7ffee6a1de2c8a42f051ba124b496de7497
SSDEEP 768:9WmXbjLCPqiBuR/skdSnToj+S+BURUTXu9wUalcB6Sf2VAtP:9WmX0uI++SWUGy99PolVsP
TLSH
T1F5135C053BED813AD6BE0B7899F1424947B5F1671513EB9B1CC400EA4923BCE86827FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$77RtkAudUService64.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77RtkAudUService64.exe.log
Size 425B
SHA256 d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140
MD5 de75c43a265d0848584ae05945570edf
SHA1 69f95177914f8d8b2f278a91f585a0024b8dffd3
SHA512 365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc
TLSH
T1EFE0683133A1A1D988573F83295C678D53BF43196650FE08B994225ED82902B6F313E3
MD5 SHA1 SHA512 TLSH

Submit Download

tmp28A1.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp28A1.tmp.bat
Size 167B
SHA256 df5bf8ae159b16b0448dd180c6a6f8c820c57e7274cf84393d0e6c0ac6b6c59e
MD5 f7e8b3db00876fec974353f6d59f364b
SHA1 ce02f0b24bd3c3be09e4111972fd63f18297f210
SHA512 859e455471b3cc2bb1ce4aa0a3e1b93090aa5e9bd5b250f28b4a8b714b54a8146500bf28cbcc87de8649c704bd5e949659497a020a6db6fa02d672970127bb69
TLSH
T14CC08052F4C55D6A14045453017A944CA1F7291D3E40B7A0438555151684C8DD499643
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2208-35-0x000000001C770000-0x000000001CAE8000-memory.dmp

Download

memory/2208-23-0x000000001C770000-0x000000001CAE8000-memory.dmp

Download

memory/2208-24-0x00000000018C0000-0x00000000018CC000-memory.dmp

Download

memory/2896-18-0x0000000001910000-0x000000000191C000-memory.dmp

Download

memory/2896-17-0x000000001C560000-0x000000001C8D8000-memory.dmp

Download

memory/4660-4-0x00000000011A0000-0x00000000011AC000-memory.dmp

Download

memory/4660-11-0x000000001C420000-0x000000001C798000-memory.dmp

Download

memory/4660-12-0x00000000011A0000-0x00000000011AC000-memory.dmp

Download

memory/4660-3-0x000000001C420000-0x000000001C798000-memory.dmp

Download

memory/4660-0-0x0000000000870000-0x000000000087E000-memory.dmp

Download

memory/4660-5-0x00000000011D0000-0x00000000011E0000-memory.dmp

Download

memory/4660-1-0x00000000011D0000-0x00000000011E0000-memory.dmp

Download

memory/4668-22-0x0000000001950000-0x000000000195C000-memory.dmp

Download

memory/4668-21-0x000000001CAE0000-0x000000001CE58000-memory.dmp

Download