Analysis
-
max time kernel
144s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2022 16:35
Static task
static1
Behavioral task
behavioral1
Sample
cmd.bat
Resource
win7-20220718-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
cmd.bat
Resource
win10v2004-20220721-en
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
oxygen-x64.dll
Resource
win7-20220715-en
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
oxygen-x64.dll
Resource
win10v2004-20220721-en
1 signatures
150 seconds
General
-
Target
cmd.bat
-
Size
187B
-
MD5
4bc3a9e4bff070d13b96623e7a6c5115
-
SHA1
34bfea8b8fa73162b83f4faf7537ea1e0224980b
-
SHA256
1e7cb59716562b1b0f306e8711e78d6f94fd6314f676b389e94f38583d3dfc6d
-
SHA512
20c9778aba533d08b014f72172a79284dde6d8bea8c118284332d6ac7b151552bf9ee1bb396f6cb992637d47c6b4c9d51eb13a6aa1258d87b2a5bffa21cec275
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 4628 wrote to memory of 1716 4628 cmd.exe rundll32.exe PID 4628 wrote to memory of 1716 4628 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\core\oxygen-x64.dat,#1 --be="license.dat"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1716-130-0x0000000000000000-mapping.dmp