Analysis
-
max time kernel
90s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
08-06-2024 21:40
Behavioral task
behavioral1
Sample
Silence Login.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Silence Login.exe
Resource
win11-20240419-en
2 signatures
150 seconds
General
-
Target
Silence Login.exe
-
Size
28KB
-
MD5
b7b782ba061b6fa0cdbac41272472e42
-
SHA1
7a4dd5691bce965d9bdf0970702669e0ab7ecd37
-
SHA256
9d423777d0bf152acf13f6017af18b64462abd6f00aa7b21fac0b0270165383b
-
SHA512
b522a3de9b0dc497ac35c456f092d22d25d328286075324c4d104fc63c00cad7cc449c78fb8bdc7c3a8c9dc60150377198bdbfe67236ed3fd86511840598027c
-
SSDEEP
768:zrYLWNcUMS+dD7U81oSybVJZSqKVBCtYcFwVc6K:PsScUM1dXU2oSCVyzVBuwVcl
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/3104-1-0x00000000004A0000-0x00000000004AC000-memory.dmp agile_net -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3084 3104 WerFault.exe Silence Login.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Silence Login.exe"C:\Users\Admin\AppData\Local\Temp\Silence Login.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 8842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3104 -ip 31041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3104-0-0x00000000747DE000-0x00000000747DF000-memory.dmpFilesize
4KB
-
memory/3104-1-0x00000000004A0000-0x00000000004AC000-memory.dmpFilesize
48KB
-
memory/3104-2-0x00000000747D0000-0x0000000074F81000-memory.dmpFilesize
7.7MB
-
memory/3104-3-0x00000000747D0000-0x0000000074F81000-memory.dmpFilesize
7.7MB