9e7f41fd174c2f47df52b296d99993f4210a87206bcb8f8a75407ba9e9ad18e9

Analysis

max time kernel
13s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 05:30

Target

Silver Rat [Re Lab]/SilverRat.exe
Size

25.2MB
MD5

d6527f7d5f5152c3f5fff6786e5c1606
SHA1

e8da82b4a3d2b6bee04236162e5e46e636310ec6
SHA256

79a4605d24d32f992d8e144202e980bb6b52bf8c9925b1498a1da59e50ac51f9
SHA512

2b4eb9e66028d263c52b3da42fa3df256cf49cd7a7ebdf7c75da6a2dedfd2c22cb5f2071345b7016cd742539c74a801cad70c612330be79802fa19f860ea2d5f
SSDEEP

786432:SZYRGnGvovVvAuuglekvAR4vzHcv6lHGH9KdDmvQuLGgJMKV+n9n1vgvVv2jlv1S:Ik79a

Score

7^/10

Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
agilenet

Processes:

resource yara_rule

behavioral3/memory/848-6-0x0000000007CA0000-0x0000000007CEE000-memory.dmp agile_net
behavioral3/memory/848-12-0x0000000009750000-0x000000000989E000-memory.dmp agile_net
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2676 848 WerFault.exe SilverRat.exe
5116 848 WerFault.exe SilverRat.exe

resource	yara_rule
behavioral3/memory/848-6-0x0000000007CA0000-0x0000000007CEE000-memory.dmp	agile_net
behavioral3/memory/848-12-0x0000000009750000-0x000000000989E000-memory.dmp	agile_net

pid	pid_target	process	target process
2676	848	WerFault.exe	SilverRat.exe
5116	848	WerFault.exe	SilverRat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

SilverRat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SilverRat.exe

description pid process

Token: SeDebugPrivilege 848 SilverRat.exe

description	pid	process
Token: SeDebugPrivilege	848	SilverRat.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 1260
2⤵
- Program crash
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 1260
2⤵
- Program crash
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 848 -ip 848
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 848 -ip 848
1⤵
PID:5016

memory/848-0-0x000000007514E000-0x000000007514F000-memory.dmp

Filesize
4KB

Download
memory/848-1-0x0000000000BE0000-0x000000000250E000-memory.dmp

Filesize
25.2MB

Download
memory/848-2-0x0000000007420000-0x00000000079C4000-memory.dmp

Filesize
5.6MB

Download
memory/848-3-0x0000000006F50000-0x0000000006FE2000-memory.dmp

Filesize
584KB

Download
memory/848-4-0x00000000079D0000-0x0000000007B46000-memory.dmp

Filesize
1.5MB

Download
memory/848-5-0x0000000007DA0000-0x0000000007EF0000-memory.dmp

Filesize
1.3MB

Download
memory/848-6-0x0000000007CA0000-0x0000000007CEE000-memory.dmp

Filesize
312KB

Download
memory/848-7-0x0000000008230000-0x0000000008482000-memory.dmp

Filesize
2.3MB

Download
memory/848-8-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/848-9-0x0000000008100000-0x000000000810A000-memory.dmp

Filesize
40KB

Download
memory/848-10-0x0000000009150000-0x0000000009182000-memory.dmp

Filesize
200KB

Download
memory/848-11-0x0000000009240000-0x00000000092DC000-memory.dmp

Filesize
624KB

Download
memory/848-12-0x0000000009750000-0x000000000989E000-memory.dmp

Filesize
1.3MB

Download
memory/848-13-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download