Analysis
- user interaction
yes - max time kernel
149s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
12/10/2026, 23:25
General
- Target Oyster.Detector.v1.1.7.exe
- Size 82.2MB
- Sample261012-3ea2laswhx
- SHA256 13190d65084067a883d9c0391e233a1e7e2f25735bb4308cc5a35905808f0ecf
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Oyster.Detector.v1.1.7.exe"C:\Users\Admin\AppData\Local\Temp\Oyster.Detector.v1.1.7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Oyster.Detector.v1.1.7.exe"C:\Users\Admin\AppData\Local\Temp\Oyster.Detector.v1.1.7.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
normal_egg_3.png
oyster.png
MSVCP140.dll
MSVCP140_1.dll
Qt6Core.dll
VCRUNTIME140_1.dll
QtCore.pyd
sip.cp313-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_brotli.cp313-win_amd64.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_tkinter.pyd
_uuid.pyd
_wmi.pyd
base_library.zip
INSTALLER
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
oyster.ico
pyexpat.pyd
python3.dll
python313.dll
select.pyd
Lorem ipsum.txt
tcl86t.dll
tk86t.dll
unicodedata.pyd
winsound.pyd
zlib1.dll
memory/2144-1268-0x00007FFF0CB50000-0x00007FFF0CB69000-memory.dmp
memory/2144-1314-0x00007FFF03080000-0x00007FFF03098000-memory.dmp
memory/2144-1292-0x00007FFF054D0000-0x00007FFF05773000-memory.dmp
memory/2144-1287-0x00007FFF131A0000-0x00007FFF131BA000-memory.dmp
memory/2144-1293-0x00007FFF03E80000-0x00007FFF03F51000-memory.dmp
memory/2144-1285-0x00007FFF043B0000-0x00007FFF0447E000-memory.dmp
memory/2144-1284-0x00007FFF04480000-0x00007FFF044B3000-memory.dmp
memory/2144-1283-0x00007FFF13130000-0x00007FFF13157000-memory.dmp
memory/2144-1294-0x00007FFF03DF0000-0x00007FFF03E77000-memory.dmp
memory/2144-1298-0x00007FFF03D90000-0x00007FFF03DA6000-memory.dmp
memory/2144-1299-0x00007FFF044C0000-0x00007FFF049F3000-memory.dmp
memory/2144-1276-0x00007FFF069B0000-0x00007FFF069BD000-memory.dmp
memory/2144-1275-0x00007FFF04A00000-0x00007FFF04A16000-memory.dmp
memory/2144-1274-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1300-0x00007FFF03D70000-0x00007FFF03D82000-memory.dmp
memory/2144-1302-0x00007FFF039D0000-0x00007FFF03B71000-memory.dmp
memory/2144-1303-0x00007FFF039A0000-0x00007FFF039CD000-memory.dmp
memory/2144-1270-0x00007FFF0C670000-0x00007FFF0C67D000-memory.dmp
memory/2144-1304-0x00007FFF03D50000-0x00007FFF03D66000-memory.dmp
memory/2144-1267-0x00007FFF04A30000-0x00007FFF04A55000-memory.dmp
memory/2144-1305-0x00007FFF043B0000-0x00007FFF0447E000-memory.dmp
memory/2144-1308-0x00007FFF042B0000-0x00007FFF04362000-memory.dmp
memory/2144-1309-0x00007FFF036F0000-0x00007FFF03704000-memory.dmp
memory/2144-1310-0x00007FFF036C0000-0x00007FFF036E2000-memory.dmp
memory/2144-1254-0x00007FFF06AC0000-0x00007FFF06AEB000-memory.dmp
memory/2144-1312-0x00007FFF036A0000-0x00007FFF036BB000-memory.dmp
memory/2144-1311-0x00007FFF03DF0000-0x00007FFF03E77000-memory.dmp
memory/2144-1307-0x00007FFF03710000-0x00007FFF03975000-memory.dmp
memory/2144-1306-0x00007FFF03980000-0x00007FFF03998000-memory.dmp
memory/2144-1301-0x00007FFF03B80000-0x00007FFF03D50000-memory.dmp
memory/2144-1295-0x00007FFF03DE0000-0x00007FFF03DEB000-memory.dmp
memory/2144-1296-0x00007FFF04A00000-0x00007FFF04A16000-memory.dmp
memory/2144-1297-0x00007FFF03DB0000-0x00007FFF03DD8000-memory.dmp
memory/2144-1288-0x00007FFF04370000-0x00007FFF043A7000-memory.dmp
memory/2144-1279-0x00007FFF044C0000-0x00007FFF049F3000-memory.dmp
memory/2144-1277-0x00007FFF04A20000-0x00007FFF04A2F000-memory.dmp
memory/2144-1260-0x00007FFF054D0000-0x00007FFF05773000-memory.dmp
memory/2144-1220-0x00007FFF13130000-0x00007FFF13157000-memory.dmp
memory/2144-1223-0x00007FFF13200000-0x00007FFF1320F000-memory.dmp
memory/2144-1290-0x00007FFF042B0000-0x00007FFF04362000-memory.dmp
memory/2144-1313-0x00007FFF03B80000-0x00007FFF03D50000-memory.dmp
memory/2144-1316-0x00007FFF03030000-0x00007FFF0307D000-memory.dmp
memory/2144-1317-0x00007FFF03D50000-0x00007FFF03D66000-memory.dmp
memory/2144-1318-0x00007FFF03010000-0x00007FFF03021000-memory.dmp
memory/2144-1315-0x00007FFF039D0000-0x00007FFF03B71000-memory.dmp
memory/2144-1319-0x00007FFF02E80000-0x00007FFF02EB2000-memory.dmp
memory/2144-1322-0x00007FFF02E40000-0x00007FFF02E4B000-memory.dmp
memory/2144-1321-0x00007FFF02E50000-0x00007FFF02E6E000-memory.dmp
memory/2144-1320-0x00007FFF03710000-0x00007FFF03975000-memory.dmp
memory/2144-1323-0x00007FFF029C0000-0x00007FFF02E40000-memory.dmp
memory/2144-1324-0x00007FFF015F0000-0x00007FFF029B8000-memory.dmp
memory/2144-1325-0x00007FFF01530000-0x00007FFF01552000-memory.dmp
memory/2144-1339-0x00007FFF04480000-0x00007FFF044B3000-memory.dmp
memory/2144-1336-0x00007FFF04A20000-0x00007FFF04A2F000-memory.dmp
memory/2144-1326-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1354-0x00007FFF03030000-0x00007FFF0307D000-memory.dmp
memory/2144-1352-0x00007FFF03010000-0x00007FFF03021000-memory.dmp
memory/2144-1327-0x00007FFF13130000-0x00007FFF13157000-memory.dmp
memory/2144-1225-0x00007FFF131A0000-0x00007FFF131BA000-memory.dmp
memory/2144-1374-0x00007FFF029C0000-0x00007FFF02E40000-memory.dmp
memory/2144-1390-0x00007FFF015F0000-0x00007FFF029B8000-memory.dmp
memory/2144-1212-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1439-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1445-0x00007FFF04A30000-0x00007FFF04A55000-memory.dmp
memory/2144-1463-0x00007FFF03D50000-0x00007FFF03D66000-memory.dmp
memory/2144-1453-0x00007FFF04480000-0x00007FFF044B3000-memory.dmp
memory/2144-1444-0x00007FFF054D0000-0x00007FFF05773000-memory.dmp
memory/2144-1478-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1506-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1534-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1562-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1590-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1618-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1646-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1674-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1702-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1730-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1758-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp
memory/2144-1786-0x00007FFF05960000-0x00007FFF05FCC000-memory.dmp