Analysis

  • max time kernel
    87s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-03-2024 07:12

General

  • Target

    OctoSniff.exe

  • Size

    17.2MB

  • MD5

    46735989b55ac72415a4a81db7ae80f5

  • SHA1

    d617a9a20b883cf76dd25c6012431f1986edbf37

  • SHA256

    139c77f42d7f66ecdafbaa7ab063b8caaddec726b64bfb2b71c3e9822d24acd7

  • SHA512

    2204045fa0744ec43b239893ac9038758cebb27b16ab9a9d1fbb48efde4f8e31786f1578505beca82c0f74beb685fa493520358369c5472f0831065e1dfdf5d5

  • SSDEEP

    393216:9JQaPHrQqXs140qMhu8369sV+HLz9SKUeNdDhHidcyNWi/x3E8sXzphsBOO0FmPR:9JQaPHrQqXs140qMhlK9sV+HLz9SKUeW

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OctoSniff.exe
    "C:\Users\Admin\AppData\Local\Temp\OctoSniff.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1764-0-0x00007FFD450F0000-0x00007FFD45BB1000-memory.dmp

    Filesize

    10.8MB

  • memory/1764-1-0x000000001ADD0000-0x000000001AF70000-memory.dmp

    Filesize

    1.6MB

  • memory/1764-3-0x000000001ADD0000-0x000000001AF70000-memory.dmp

    Filesize

    1.6MB

  • memory/1764-4-0x00007FFD450F0000-0x00007FFD45BB1000-memory.dmp

    Filesize

    10.8MB

  • memory/1764-2-0x000000001ADD0000-0x000000001AF70000-memory.dmp

    Filesize

    1.6MB

  • memory/1764-7-0x0000000002090000-0x0000000002091000-memory.dmp

    Filesize

    4KB

  • memory/1764-15-0x00007FFD632A0000-0x00007FFD632A1000-memory.dmp

    Filesize

    4KB

  • memory/1764-17-0x00007FFD63CF0000-0x00007FFD63EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1764-14-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/1764-19-0x00007FFD63BD0000-0x00007FFD63BD1000-memory.dmp

    Filesize

    4KB

  • memory/1764-21-0x00007FFD63B10000-0x00007FFD63B11000-memory.dmp

    Filesize

    4KB

  • memory/1764-18-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/1764-24-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/1764-25-0x00007FFD63AB0000-0x00007FFD63AB1000-memory.dmp

    Filesize

    4KB

  • memory/1764-26-0x00007FFD63CE0000-0x00007FFD63CE1000-memory.dmp

    Filesize

    4KB

  • memory/1764-30-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/1764-28-0x00007FFD63CD0000-0x00007FFD63CD1000-memory.dmp

    Filesize

    4KB

  • memory/1764-22-0x00007FFD63B00000-0x00007FFD63B01000-memory.dmp

    Filesize

    4KB

  • memory/1764-33-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/1764-37-0x00007FFD63B20000-0x00007FFD63B21000-memory.dmp

    Filesize

    4KB

  • memory/1764-39-0x00007FFD63B50000-0x00007FFD63B51000-memory.dmp

    Filesize

    4KB

  • memory/1764-38-0x00007FFD63B30000-0x00007FFD63B31000-memory.dmp

    Filesize

    4KB

  • memory/1764-40-0x00007FFD63B70000-0x00007FFD63B71000-memory.dmp

    Filesize

    4KB

  • memory/1764-41-0x00007FFD63CF0000-0x00007FFD63EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1764-43-0x000000001D090000-0x000000001D548000-memory.dmp

    Filesize

    4.7MB

  • memory/1764-47-0x00007FFD63BB0000-0x00007FFD63BB1000-memory.dmp

    Filesize

    4KB

  • memory/1764-45-0x00007FFD63CB0000-0x00007FFD63CB1000-memory.dmp

    Filesize

    4KB

  • memory/1764-42-0x000000001ADC0000-0x000000001ADD0000-memory.dmp

    Filesize

    64KB

  • memory/1764-46-0x000000001D090000-0x000000001D548000-memory.dmp

    Filesize

    4.7MB

  • memory/1764-49-0x00007FFD63BA0000-0x00007FFD63BA1000-memory.dmp

    Filesize

    4KB

  • memory/1764-52-0x00007FFD63B40000-0x00007FFD63B41000-memory.dmp

    Filesize

    4KB

  • memory/1764-50-0x00007FFD63AA0000-0x00007FFD63AA1000-memory.dmp

    Filesize

    4KB

  • memory/1764-53-0x000000001D090000-0x000000001D548000-memory.dmp

    Filesize

    4.7MB

  • memory/1764-55-0x00007FFD63CC0000-0x00007FFD63CC1000-memory.dmp

    Filesize

    4KB

  • memory/1764-57-0x000000001D090000-0x000000001D548000-memory.dmp

    Filesize

    4.7MB

  • memory/1764-64-0x000000001DD70000-0x000000001E228000-memory.dmp

    Filesize

    4.7MB

  • memory/1764-81-0x00007FFD63AF0000-0x00007FFD63AF1000-memory.dmp

    Filesize

    4KB

  • memory/1764-82-0x00007FFD63AE0000-0x00007FFD63AE1000-memory.dmp

    Filesize

    4KB

  • memory/1764-83-0x000000001F0A0000-0x000000001F0AA000-memory.dmp

    Filesize

    40KB

  • memory/1764-85-0x000000001F0A0000-0x000000001F0AA000-memory.dmp

    Filesize

    40KB

  • memory/1764-99-0x000000001F0B0000-0x000000001F0BA000-memory.dmp

    Filesize

    40KB

  • memory/1764-106-0x000000001ADC0000-0x000000001ADD0000-memory.dmp

    Filesize

    64KB

  • memory/1764-112-0x000000001F8A0000-0x000000001F8E4000-memory.dmp

    Filesize

    272KB

  • memory/1764-113-0x0000000020010000-0x000000002072A000-memory.dmp

    Filesize

    7.1MB

  • memory/1764-114-0x00007FFD450F0000-0x00007FFD45BB1000-memory.dmp

    Filesize

    10.8MB

  • memory/1764-115-0x000000001ADC0000-0x000000001ADD0000-memory.dmp

    Filesize

    64KB

  • memory/1764-116-0x000000001FBB0000-0x000000001FBF0000-memory.dmp

    Filesize

    256KB

  • memory/1764-117-0x000000001FC80000-0x000000001FD0C000-memory.dmp

    Filesize

    560KB

  • memory/1764-118-0x000000001FE10000-0x000000001FEDC000-memory.dmp

    Filesize

    816KB

  • memory/1764-123-0x000000001ADD0000-0x000000001AF70000-memory.dmp

    Filesize

    1.6MB

  • memory/1764-124-0x00007FFCE5BA0000-0x00007FFCE5C20000-memory.dmp

    Filesize

    512KB

  • memory/1764-125-0x00007FFCE5BA0000-0x00007FFCE5C20000-memory.dmp

    Filesize

    512KB

  • memory/1764-126-0x00007FFCE5BA0000-0x00007FFCE5C20000-memory.dmp

    Filesize

    512KB

  • memory/1764-127-0x000000001FB90000-0x000000001FB96000-memory.dmp

    Filesize

    24KB

  • memory/1764-128-0x000000001FBA0000-0x000000001FBA6000-memory.dmp

    Filesize

    24KB

  • memory/1764-129-0x00007FFD63CF0000-0x00007FFD63EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1764-131-0x00000000209E0000-0x0000000020A90000-memory.dmp

    Filesize

    704KB

  • memory/1764-130-0x00007FFD63B60000-0x00007FFD63B61000-memory.dmp

    Filesize

    4KB

  • memory/1764-132-0x000000001FC50000-0x000000001FC72000-memory.dmp

    Filesize

    136KB

  • memory/1764-134-0x00007FFD63CF0000-0x00007FFD63EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1764-135-0x00007FFD63BC0000-0x00007FFD63BC1000-memory.dmp

    Filesize

    4KB

  • memory/1764-141-0x00007FFD63CF0000-0x00007FFD63EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1764-144-0x000000001ADC0000-0x000000001ADD0000-memory.dmp

    Filesize

    64KB

  • memory/1764-161-0x00007FFD450F0000-0x00007FFD45BB1000-memory.dmp

    Filesize

    10.8MB

  • memory/1764-162-0x00007FFD63CF0000-0x00007FFD63EE5000-memory.dmp

    Filesize

    2.0MB