silverrat | 0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840

Analysis

max time kernel
60s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
Size 44KB
Sample260906-xrjava1bnf
SHA256 0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840
MD5 ca5c8dd1b3be8e1d5ab5dbc8f13e0814
SHA1 e928a1f77425b05c77e8d0732050b32080d35a95
SHA512 cc23076421fb62a9145c86ef33a2992742b19f794c72836d74af833b989f61cb6aac610f313d341daee025285cab92564b42d4ac387816b03554db1c24692388
SSDEEP 768:FFGuOEzmtXHCK2GdtId2RUT0rS9wLgz1QB6Ssucva/BB72:FFihIIGA+911QoecS/f72
TLSH
T1E6134A047BDC862AD7FE4B7D9AB1521545B5E1A72213D78E0CC840EB0E237CD8985BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution silverrat persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

requirements-experiment.gl.at.ply.gg:48608

Mutex

lAxDBRhAFu

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
discord
https://discordapp.com/api/webhooks/1374393872116875294/juFv-tosLmN5P6Si-77YhRQO6IioEiKv5Jwzw9mQXH936LYLO1ydA3AhhdamOd2Sa5Q6
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
b0FGeVZNcFRMWVloVHR6Z0VESU5RdlpZUmxZbUFE
payload_url
https://g.top4top.io/p_2522c7w8u1.png
reconnect_delay
4
server_signature
t9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=

Signatures

Family: SilverRat
SilverRat is trojan written in C#.
trojan silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3272	attrib.exe
2520	attrib.exe

Executes dropped EXE 3 IoCs

pid	Process
4724	$77xd.exe
3412	$77xd.exe
4276	$77xd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\xd\\$77xd.exe\""	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5560	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3340	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5996	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
5560	powershell.exe
5560	powershell.exe
5560	powershell.exe
4724	$77xd.exe
4724	$77xd.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
Token: SeDebugPrivilege	4724	$77xd.exe
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeIncreaseQuotaPrivilege	5560	powershell.exe
Token: SeSecurityPrivilege	5560	powershell.exe
Token: SeTakeOwnershipPrivilege	5560	powershell.exe
Token: SeLoadDriverPrivilege	5560	powershell.exe
Token: SeSystemProfilePrivilege	5560	powershell.exe
Token: SeSystemtimePrivilege	5560	powershell.exe
Token: SeProfSingleProcessPrivilege	5560	powershell.exe
Token: SeIncBasePriorityPrivilege	5560	powershell.exe
Token: SeCreatePagefilePrivilege	5560	powershell.exe
Token: SeBackupPrivilege	5560	powershell.exe
Token: SeRestorePrivilege	5560	powershell.exe
Token: SeShutdownPrivilege	5560	powershell.exe
Token: SeDebugPrivilege	5560	powershell.exe
Token: SeSystemEnvironmentPrivilege	5560	powershell.exe
Token: SeRemoteShutdownPrivilege	5560	powershell.exe
Token: SeUndockPrivilege	5560	powershell.exe
Token: SeManageVolumePrivilege	5560	powershell.exe
Token: 33	5560	powershell.exe
Token: 34	5560	powershell.exe
Token: 35	5560	powershell.exe
Token: 36	5560	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4724	$77xd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 3272	548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe	89
PID 548 wrote to memory of 2520	548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe	91
PID 548 wrote to memory of 3340	548	0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe	93
PID 3340 wrote to memory of 5996	3340	cmd.exe	95
PID 4724 wrote to memory of 3436	4724	$77xd.exe	98
PID 4724 wrote to memory of 1848	4724	$77xd.exe	100
PID 4724 wrote to memory of 5192	4724	$77xd.exe	102
PID 4724 wrote to memory of 5560	4724	$77xd.exe	104
PID 3340 wrote to memory of 4276	3340	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3272	attrib.exe
2520	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe
"C:\Users\Admin\AppData\Local\Temp\0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\xd"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3272
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\xd\$77xd.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2178.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5996
- - C:\Users\Admin\xd\$77xd.exe
    "C:\Users\Admin\xd\$77xd.exe"
    3⤵
    - Executes dropped EXE
    PID:4276

C:\Users\Admin\xd\$77xd.exe
"C:\Users\Admin\xd\$77xd.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /TN $77xd.exe
  2⤵
  PID:3436
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /Create /SC ONCE /TN "$77xd.exe" /TR "C:\Users\Admin\xd\$77xd.exe \"\$77xd.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1848
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /TN $77xd.exe
  2⤵
  PID:5192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5560

C:\Users\Admin\xd\$77xd.exe
C:\Users\Admin\xd\$77xd.exe
1⤵
- Executes dropped EXE
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp2178.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp2178.tmp.bat
Size 136B
SHA256 458b918216211cd8a25672b74726e6415eeeb104d4142e295c0638a20e05999b
MD5 4df8dbc0b6af600e60e244dfad4c74b8
SHA1 37ca80f101dfd2c4ecc6f9101ba0969f6de5a2e9
SHA512 5ede6c857225f6637f191ec12cab65f7367609d337a5df5d28bc59fc24d4357fb77b2a4cb713d27dccdbb5cdbcb2d2c0968ce466b1fc00d91d679f46154c99f1
TLSH
T1F9C02B5370C6AA5F1808982302FA96CDA1A22C1A3E50B720835440051240448E0DB741
MD5 SHA1 SHA512 TLSH

Submit Download

$77xd.exe

Path C:\Users\Admin\xd\$77xd.exe
Size 44KB
SHA256 0efec82335372cf07dd357027d06edc9ef4be40e1c3ed2d734a2df8dffc8f840
MD5 ca5c8dd1b3be8e1d5ab5dbc8f13e0814
SHA1 e928a1f77425b05c77e8d0732050b32080d35a95
SHA512 cc23076421fb62a9145c86ef33a2992742b19f794c72836d74af833b989f61cb6aac610f313d341daee025285cab92564b42d4ac387816b03554db1c24692388
SSDEEP 768:FFGuOEzmtXHCK2GdtId2RUT0rS9wLgz1QB6Ssucva/BB72:FFihIIGA+911QoecS/f72
TLSH
T1E6134A047BDC862AD7FE4B7D9AB1521545B5E1A72213D78E0CC840EB0E237CD8985BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-8-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/548-12-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/548-4-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/548-5-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/548-6-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/548-7-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/548-0-0x00000000005D0000-0x00000000005E0000-memory.dmp

Download

memory/548-3-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/548-2-0x00007FF914BF0000-0x00007FF915594000-memory.dmp

Download

memory/548-1-0x00007FF914D7F000-0x00007FF914D80000-memory.dmp

Download

memory/4724-27-0x000000001EE30000-0x000000001EE5D000-memory.dmp

Download

memory/5560-16-0x000001E331A50000-0x000001E331A72000-memory.dmp

Download

memory/5560-22-0x000001E331B10000-0x000001E331B2E000-memory.dmp

Download

memory/5560-23-0x000001E331D50000-0x000001E331E02000-memory.dmp

Download

memory/5560-24-0x000001E331B30000-0x000001E331B3A000-memory.dmp

Download