Overview
overview
8Static
static
3Amazon___D...en.rar
windows7-x64
3Amazon___D...en.rar
windows10-2004-x64
3Amazon & D...ibutes
windows7-x64
1Amazon & D...ibutes
windows10-2004-x64
1Amazon & D...et.dll
windows7-x64
1Amazon & D...et.dll
windows10-2004-x64
1Amazon & D...ICENSE
windows7-x64
1Amazon & D...ICENSE
windows10-2004-x64
1Amazon & D...E!.txt
windows7-x64
1Amazon & D...E!.txt
windows10-2004-x64
1Amazon & D...en.exe
windows7-x64
8Amazon & D...en.exe
windows10-2004-x64
8Amazon & D...op.ini
windows7-x64
1Amazon & D...op.ini
windows10-2004-x64
1Amazon & D...an.txt
windows7-x64
1Amazon & D...an.txt
windows10-2004-x64
1Amazon & D...er.dll
windows7-x64
1Amazon & D...er.dll
windows10-2004-x64
1Amazon & D...it.dll
windows7-x64
1Amazon & D...it.dll
windows10-2004-x64
1Amazon & D...ip.dll
windows7-x64
1Amazon & D...ip.dll
windows10-2004-x64
1Amazon & D...CE.zip
windows7-x64
1Amazon & D...CE.zip
windows10-2004-x64
1Amazon & D...er.exe
windows7-x64
8Amazon & D...er.exe
windows10-2004-x64
8Amazon & D...E!.txt
windows7-x64
1Amazon & D...E!.txt
windows10-2004-x64
1Amazon & D...it.dll
windows7-x64
1Amazon & D...it.dll
windows10-2004-x64
1Amazon & D...db.exe
windows7-x64
7Amazon & D...db.exe
windows10-2004-x64
7Resubmissions
26-09-2022 21:20
220926-z66e2acab9 8Analysis
-
max time kernel
124s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 21:20
Behavioral task
behavioral1
Sample
Amazon___Dicord_Gen_By_ShadowOxygen.rar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Amazon___Dicord_Gen_By_ShadowOxygen.rar
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Amazon & Dicord Gen By ShadowOxygen/.gitattributes
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Amazon & Dicord Gen By ShadowOxygen/.gitattributes
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Amazon & Dicord Gen By ShadowOxygen/Extreme.Net.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Amazon & Dicord Gen By ShadowOxygen/Extreme.Net.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Amazon & Dicord Gen By ShadowOxygen/LICENSE
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Amazon & Dicord Gen By ShadowOxygen/LICENSE
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Amazon & Dicord Gen By ShadowOxygen/README!.txt
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Amazon & Dicord Gen By ShadowOxygen/README!.txt
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Amazon & Dicord Gen By ShadowOxygen/ShadowGen.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
Amazon & Dicord Gen By ShadowOxygen/ShadowGen.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Amazon & Dicord Gen By ShadowOxygen/Virus Total/desktop.ini
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Amazon & Dicord Gen By ShadowOxygen/Virus Total/desktop.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Amazon & Dicord Gen By ShadowOxygen/Virus Total/scan.txt
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Amazon & Dicord Gen By ShadowOxygen/Virus Total/scan.txt
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Amazon & Dicord Gen By ShadowOxygen/WebDriver.dll
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
Amazon & Dicord Gen By ShadowOxygen/WebDriver.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
Amazon & Dicord Gen By ShadowOxygen/Xceed.Wpf.Toolkit.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Amazon & Dicord Gen By ShadowOxygen/Xceed.Wpf.Toolkit.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Ionic.Zip.dll
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Ionic.Zip.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/LICENCE.zip
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/LICENCE.zip
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Launcher.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Launcher.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/README!.txt
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/README!.txt
Resource
win10v2004-20220901-en
Behavioral task
behavioral29
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Xceed.Wpf.Toolkit.dll
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Xceed.Wpf.Toolkit.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/db.exe
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/db.exe
Resource
win10v2004-20220901-en
General
-
Target
Amazon & Dicord Gen By ShadowOxygen/bin/db.exe
-
Size
5.1MB
-
MD5
dc28a95657072fc5b40f011c8078bb80
-
SHA1
11e0fdd502cd881814885285c05ed5b61e164636
-
SHA256
24a95e0286a530b5962a48ccf0246b1f0bfb35b77a25d4792e16cfdf675c26d5
-
SHA512
80dcc85fefff319f508b1a90a9bc9beefe42003e7ab9092d4697b64c3fbddbbffb3fe2d07e295329df5a10fc7f527167d085c9c6d858f5d014c79ecc5b717446
-
SSDEEP
98304:9h55mrHQktlw2Kce26t+JhVWn2xxjsOIzsU8Ys04RRNNH:9h5u3tlKXqXWnA1IzXtXiNH
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
db.exepid process 1988 db.exe 1988 db.exe 1988 db.exe 1988 db.exe 1988 db.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
db.exedescription pid process Token: 35 1988 db.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
db.exedescription pid process target process PID 4884 wrote to memory of 1988 4884 db.exe db.exe PID 4884 wrote to memory of 1988 4884 db.exe db.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Amazon & Dicord Gen By ShadowOxygen\bin\db.exe"C:\Users\Admin\AppData\Local\Temp\Amazon & Dicord Gen By ShadowOxygen\bin\db.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Amazon & Dicord Gen By ShadowOxygen\bin\db.exe"C:\Users\Admin\AppData\Local\Temp\Amazon & Dicord Gen By ShadowOxygen\bin\db.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\VCRUNTIME140.dllFilesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\VCRUNTIME140.dllFilesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\_ctypes.pydFilesize
129KB
MD52f21f50d2252e3083555a724ca57b71e
SHA149ec351d569a466284b8cc55ee9aeaf3fbf20099
SHA25609887f07f4316057d3c87e3a907c2235dc6547e54ed4f5f9125f99e547d58bce
SHA512e71ff1e63105f51a4516498cd09f8156d7208758c5dc9a74e7654844e5cefc6e84f8fe98a1f1bd7a459a98965fbe913cb5edb552fffa1e33dfda709f918dddeb
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\_ctypes.pydFilesize
129KB
MD52f21f50d2252e3083555a724ca57b71e
SHA149ec351d569a466284b8cc55ee9aeaf3fbf20099
SHA25609887f07f4316057d3c87e3a907c2235dc6547e54ed4f5f9125f99e547d58bce
SHA512e71ff1e63105f51a4516498cd09f8156d7208758c5dc9a74e7654844e5cefc6e84f8fe98a1f1bd7a459a98965fbe913cb5edb552fffa1e33dfda709f918dddeb
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\_hashlib.pydFilesize
38KB
MD5c3b19ad5381b9832e313a448de7c5210
SHA151777d53e1ea5592efede1ed349418345b55f367
SHA256bdf4a536f783958357d2e0055debdc3cf7790ee28beb286452eec0354a346bdc
SHA5127f8d3b79a58612e850d18e8952d14793e974483c688b5daee217baaa83120fd50d1e036ca4a1b59d748b22951744377257d2a8f094a4b4de1f79fecd4bf06afb
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\_hashlib.pydFilesize
38KB
MD5c3b19ad5381b9832e313a448de7c5210
SHA151777d53e1ea5592efede1ed349418345b55f367
SHA256bdf4a536f783958357d2e0055debdc3cf7790ee28beb286452eec0354a346bdc
SHA5127f8d3b79a58612e850d18e8952d14793e974483c688b5daee217baaa83120fd50d1e036ca4a1b59d748b22951744377257d2a8f094a4b4de1f79fecd4bf06afb
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\base_library.zipFilesize
760KB
MD5057917a14cf42e6a27902be13bf1b5af
SHA1c1e2437235b002a77f88fe7938b4bef560499739
SHA256be8e5189ce4183ef24cbc06c8db98f7da16b9b236e6375450b688bd51fedf224
SHA51231951fa321971a8a273cdbf0f9c7fae7b4f9880d2b7ab64e324562b5fa0650c053db099b760cc3cfe4033296bb7b26cb7d3d94f5bac3b50d3afce8a3d01a3cb8
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\libcrypto-1_1-x64.dllFilesize
2.4MB
MD5022a61849adab67e3a59bcf4d0f1c40b
SHA1fca2e1e8c30767c88f7ab5b42fe2bd9abb644672
SHA2562a57183839c3e9cc4618fb1994c40e47672a8b6daffaa76c5f89cf2542b02c2f
SHA51294ac596181f0887af7bf02a7ce31327ad443bb7fe2d668217953e0f0c782d19296a80de965008118708afd9bda14fd8c78f49785ebf7abcc37d166b692e88246
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\libcrypto-1_1-x64.dllFilesize
2.4MB
MD5022a61849adab67e3a59bcf4d0f1c40b
SHA1fca2e1e8c30767c88f7ab5b42fe2bd9abb644672
SHA2562a57183839c3e9cc4618fb1994c40e47672a8b6daffaa76c5f89cf2542b02c2f
SHA51294ac596181f0887af7bf02a7ce31327ad443bb7fe2d668217953e0f0c782d19296a80de965008118708afd9bda14fd8c78f49785ebf7abcc37d166b692e88246
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\python37.dllFilesize
3.7MB
MD562125a78b9be5ac58c3b55413f085028
SHA146c643f70dd3b3e82ab4a5d1bc979946039e35b2
SHA25617c29e6188b022f795092d72a1fb58630a7c723d70ac5bc3990b20cd2eb2a51f
SHA512e63f4aa8fc5cd1569ae401e283bc8e1445859131eb0db76581b941f1085670c549cbc3fedf911a21c1237b0f3f66f62b10c60e88b923fa058f7fafee18dd0fa4
-
C:\Users\Admin\AppData\Local\Temp\_MEI48842\python37.dllFilesize
3.7MB
MD562125a78b9be5ac58c3b55413f085028
SHA146c643f70dd3b3e82ab4a5d1bc979946039e35b2
SHA25617c29e6188b022f795092d72a1fb58630a7c723d70ac5bc3990b20cd2eb2a51f
SHA512e63f4aa8fc5cd1569ae401e283bc8e1445859131eb0db76581b941f1085670c549cbc3fedf911a21c1237b0f3f66f62b10c60e88b923fa058f7fafee18dd0fa4
-
memory/1988-132-0x0000000000000000-mapping.dmp