Overview
overview
7Static
static
3ShadowGen ...rp.exe
windows7-x64
7ShadowGen ...rp.exe
windows11-21h2-x64
7shadowgen.pyc
windows10-2004-x64
3shadowgen.pyc
windows11-21h2-x64
3ShadowGen ...et.dll
windows10-1703-x64
1ShadowGen ...et.dll
windows11-21h2-x64
1ShadowGen ...en.exe
windows10-2004-x64
7ShadowGen ...en.exe
windows11-21h2-x64
7ShadowGen ...er.dll
windows7-x64
1ShadowGen ...er.dll
windows11-21h2-x64
1ShadowGen ...it.dll
windows10-1703-x64
1ShadowGen ...it.dll
windows11-21h2-x64
1ShadowGen ...32.exe
windows10-1703-x64
1ShadowGen ...32.exe
windows11-21h2-x64
1ShadowGen ...ef.exe
windows7-x64
1ShadowGen ...ef.exe
windows11-21h2-x64
1ShadowGen ...32.dll
windows10-1703-x64
1ShadowGen ...32.dll
windows11-21h2-x64
1ShadowGen ...oc.dll
windows11-21h2-x64
1ShadowGen ...oc.dll
windows11-21h2-x64
1Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-06-2024 19:50
Behavioral task
behavioral1
Sample
ShadowGen By ShadowOxygen/CefSharp.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ShadowGen By ShadowOxygen/CefSharp.exe
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
shadowgen.pyc
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
shadowgen.pyc
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
ShadowGen By ShadowOxygen/Extreme.Net.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
ShadowGen By ShadowOxygen/Extreme.Net.dll
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
ShadowGen By ShadowOxygen/ShadowGen By ShadowOxygen.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
ShadowGen By ShadowOxygen/ShadowGen By ShadowOxygen.exe
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
ShadowGen By ShadowOxygen/WebDriver.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
ShadowGen By ShadowOxygen/WebDriver.dll
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
ShadowGen By ShadowOxygen/Xceed.Wpf.Toolkit.dll
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
ShadowGen By ShadowOxygen/Xceed.Wpf.Toolkit.dll
Resource
win11-20240426-en
Behavioral task
behavioral13
Sample
ShadowGen By ShadowOxygen/bin32.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
ShadowGen By ShadowOxygen/bin32.exe
Resource
win11-20240419-en
Behavioral task
behavioral15
Sample
ShadowGen By ShadowOxygen/libcef.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
ShadowGen By ShadowOxygen/libcef.exe
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
ShadowGen By ShadowOxygen/msacm32.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
ShadowGen By ShadowOxygen/msacm32.dll
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
ShadowGen By ShadowOxygen/secproc.dll
Resource
win11-20240426-en
Behavioral task
behavioral20
Sample
ShadowGen By ShadowOxygen/secproc.dll
Resource
win11-20240508-en
General
-
Target
ShadowGen By ShadowOxygen/msacm32.dll
-
Size
91KB
-
MD5
67705d9f5cc5b1b5369020db75a96cca
-
SHA1
361570bd4996035fae9a00643e2702af71c20258
-
SHA256
a81f6c00abb9f93e087e7cc327152548d48ac41e4e87b641d35de9ee9c32c428
-
SHA512
9daeb80668c3fb6ef30d7cd3ef0dc299f88ee4c00ce0abe6ccc21c345102e4a1b7584b25da8a90b2d7126df3da42fc0704db9a32f3da0a3d456a03d0e821f1e0
-
SSDEEP
1536:ifCbzJH52ngXggYD/Yi3oMfZCV75h4zlQKw2xLGO3qnjG7pPzsk:ieVkgYDAi3omMVhcl7CO6njGV7H
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 1268 wrote to memory of 4024 1268 rundll32.exe 80 PID 1268 wrote to memory of 4024 1268 rundll32.exe 80 PID 1268 wrote to memory of 4024 1268 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\ShadowGen By ShadowOxygen\msacm32.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\ShadowGen By ShadowOxygen\msacm32.dll",#12⤵PID:4024
-