Overview
overview
10Static
static
10Octo Banki...et.zip
windows7-x64
1Octo Banki...et.zip
windows10-2004-x64
1www/server...kie.js
windows7-x64
1www/server...kie.js
windows10-2004-x64
1www/server...ery.js
windows7-x64
1www/server...ery.js
windows10-2004-x64
1www/server...vnc.js
windows7-x64
1www/server...vnc.js
windows10-2004-x64
1www/server...p.html
windows7-x64
1www/server...p.html
windows10-2004-x64
1www/server...u.html
windows7-x64
1www/server...u.html
windows10-2004-x64
1www/server...s.html
windows7-x64
1www/server...s.html
windows10-2004-x64
1www/server...o.html
windows7-x64
1www/server...o.html
windows10-2004-x64
1www/server...w.html
windows7-x64
1www/server...w.html
windows10-2004-x64
1www/server...s.html
windows7-x64
1www/server...s.html
windows10-2004-x64
1www/server...m.html
windows7-x64
1www/server...m.html
windows10-2004-x64
1www/server...s.html
windows7-x64
1www/server...s.html
windows10-2004-x64
1www/server...s.html
windows7-x64
1www/server...s.html
windows10-2004-x64
1www/server...r.html
windows7-x64
1www/server...r.html
windows10-2004-x64
1www/server...r.html
windows7-x64
1www/server...r.html
windows10-2004-x64
1www/server...s.html
windows7-x64
1www/server...s.html
windows10-2004-x64
1Analysis
-
max time kernel
0s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2024 04:18
Behavioral task
behavioral1
Sample
Octo Banking Botnet.zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Octo Banking Botnet.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/rc/jquery.cookie.js
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/rc/jquery.cookie.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/rc/jquery.js
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/rc/jquery.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/rc/vnc.js
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/rc/vnc.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/_vnc_help.html
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/_vnc_help.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/_vnc_help_ru.html
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/_vnc_help_ru.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/apks.html
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/apks.html
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/bot_info.html
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/bot_info.html
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/bot_row.html
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/bot_row.html
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/bots.html
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/bots.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/command_form.html
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/command_form.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/commands.html
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/commands.html
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/errors.html
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/errors.html
Resource
win10v2004-20231222-en
Behavioral task
behavioral27
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/footer.html
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/footer.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/header.html
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/header.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/logs.html
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/logs.html
Resource
win10v2004-20231215-en
General
-
Target
www/server_www/rootMD50MA/panelcGFuZWxleG9kdXNvY3Rv/tpls/errors.html
-
Size
1KB
-
MD5
2135fe2bc9cc6a51cea552113e42fb15
-
SHA1
5c8f8c983f282b6efbbb70eb737ee8d2e21a915a
-
SHA256
33c50f6c5042956859053efcb6db867364c790ccd59da81d55c84d2f73c225fc
-
SHA512
f56e7d07e209309a4653aa1db8c122da925baac5af673c67ea247122ab5f9acb02a6c385fa26c7dd6f72206e0d458ae694e997b6113b8239891e8fd8e03c61e7
Malware Config
Signatures
-
Processes:
iexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{04F4DABE-AD14-11EE-AA35-6AA3E029E500} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
iexplore.exepid process 4992 iexplore.exe 4992 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4992 wrote to memory of 5188 4992 iexplore.exe IEXPLORE.EXE PID 4992 wrote to memory of 5188 4992 iexplore.exe IEXPLORE.EXE PID 4992 wrote to memory of 5188 4992 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\www\server_www\rootMD50MA\panelcGFuZWxleG9kdXNvY3Rv\tpls\errors.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4992 CREDAT:17410 /prefetch:22⤵PID:5188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoFilesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e