Kaspersky researchers discovered a new malware dubbed “SilentBreak,” which deploys malware in-memory inside Windows event logs. A custom malware dropper copies the legitimate executable file “WerFault.exe” to the “C:\Windows\Tasks” directory, allowing the program to launch as an automatically executed task. The dropper then copies a DLL file named “wer.dll” that stores the malicious code to the same directory, tricking the legitimate program into running it. The entry point to the malware is launched where it adds the malicious shell code to the event logs then compiles the data into a program in-memory and executes it. The main piece of the malware uses code from GitHub as well as proprietary tools such as Cobalt Strike to gather more information on the infected machine. Kaspersky researchers have determined this threat actor to be sophisticated, and as this malware is modular, it is likely still in development. The researchers were not able to attribute the malware to a specific threat actor or location as there are no code similarities to other known malware. CTIX analysts predict more malware will utilize this new technique, especially since Proof-of-Concept (PoC) code for hiding malware in Windows event logs have been released on GitHub.