9d423777d0bf152acf13f6017af18b64462abd6f00aa7b21fac0b0270165383b | Triage

Analysis

max time kernel
196s
max time network
197s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08-06-2024 21:39

Sharing

Report Analysis Logs

General

Target

Silence Login.exe
Size

28KB
MD5

b7b782ba061b6fa0cdbac41272472e42
SHA1

7a4dd5691bce965d9bdf0970702669e0ab7ecd37
SHA256

9d423777d0bf152acf13f6017af18b64462abd6f00aa7b21fac0b0270165383b
SHA512

b522a3de9b0dc497ac35c456f092d22d25d328286075324c4d104fc63c00cad7cc449c78fb8bdc7c3a8c9dc60150377198bdbfe67236ed3fd86511840598027c
SSDEEP

768:zrYLWNcUMS+dD7U81oSybVJZSqKVBCtYcFwVc6K:PsScUM1dXU2oSCVyzVBuwVcl

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/3380-1-0x00000000004C0000-0x00000000004CC000-memory.dmp	agile_net

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5016 3380 WerFault.exe Silence Login.exe

C:\Users\Admin\AppData\Local\Temp\Silence Login.exe
"C:\Users\Admin\AppData\Local\Temp\Silence Login.exe"
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 836
2⤵
- Program crash
PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3380-0-0x00000000737DE000-0x00000000737DF000-memory.dmp

Filesize
4KB

Download
memory/3380-1-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/3380-2-0x00000000737D0000-0x0000000073EBE000-memory.dmp

Filesize
6.9MB

Download
memory/3380-3-0x00000000737D0000-0x0000000073EBE000-memory.dmp

Filesize
6.9MB

Download