18af7b44d38f8041d4ebcd0fc6d7430c9d742713f7bc988fb610bb4a834da7b2

Resubmissions

14/07/2024, 18:27

240714-w3tehsscjq10

10/07/2024, 09:23

10/07/2024, 09:19

09/07/2024, 22:42

09/07/2024, 22:28

Analysis

max time kernel
12s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oxygen.exe
Size 80.2MB
Sample240709-2dnqmazbqq
SHA256 18af7b44d38f8041d4ebcd0fc6d7430c9d742713f7bc988fb610bb4a834da7b2
MD5 0e6ef9d935d85eabe049d130d5fe705b
SHA1 4be3632e0cba0d72f0de1ee6c5ba1321e6e1a351
SHA512 83703e04edad32cc0c30649c4158dab8a3f2b9d376e78e596338e666f30461fb3d8a39a659302ceed05711e672641656f396ded9a15e8bda69073aa702f44ef7
SSDEEP 1572864:5vxZQgl0oSk8IpG7V+VPhqcPE7hlgkiYgj+h58sMwVWY99SFcJz7:5vxZxZSkB05awcSeu5BN9917
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1912	oxygen.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000400000001cf16-1260.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1912	2956	oxygen.exe	31
PID 2956 wrote to memory of 1912	2956	oxygen.exe	31
PID 2956 wrote to memory of 1912	2956	oxygen.exe	31

C:\Users\Admin\AppData\Local\Temp\oxygen.exe
"C:\Users\Admin\AppData\Local\Temp\oxygen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\oxygen.exe
  "C:\Users\Admin\AppData\Local\Temp\oxygen.exe"
  2⤵
  - Loads dropped DLL
  PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29562\python311.dll
Size 1.6MB
SHA256 43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76
MD5 546cc5fe76abc35fdbf92f682124e23d
SHA1 5c1030752d32aa067b49125194befee7b3ee985a
SHA512 cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720
SSDEEP 24576:HzvTIooNigMzmPPExBYeZ0pqJx5F7vYNBw5K2RH9lVggq4lUTNeTVZXo3uYIPDhh:v9oNizvxB3ZAEx5ONCVwXUmeTVlv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1912-1262-0x000007FEF5F60000-0x000007FEF6549000-memory.dmp

Download