Analysis
-
max time kernel
16s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 19:26
Behavioral task
behavioral1
Sample
OctoSniff.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
OctoSniff.exe
Resource
win10v2004-20240709-en
General
-
Target
OctoSniff.exe
-
Size
6.0MB
-
MD5
0894741902cd438c52718f429518c863
-
SHA1
0b736dae71076915db53dc58fa74982fdb1aa6d4
-
SHA256
e33421cb655cd14340cf2a9b10c681070227684fe980b461b29ef072281103cf
-
SHA512
5fe12f167c052cb5e0df05cacb9d41f988615544cb86ab475f7b6bf56870be88b937770aeacd69b99a03a1940a75a4202285716f2f817991f1439495ab60e87e
-
SSDEEP
98304:EbEtdFBCyqamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R4OuAKlLI6yv:ESFIweN/FJMIDJf0gsAGK4RzuAKl0Jv
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2040 OctoSniff.exe -
resource yara_rule behavioral1/files/0x0005000000019db4-21.dat upx behavioral1/memory/2040-23-0x000007FEF6AA0000-0x000007FEF6F0E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2040 2508 OctoSniff.exe 29 PID 2508 wrote to memory of 2040 2508 OctoSniff.exe 29 PID 2508 wrote to memory of 2040 2508 OctoSniff.exe 29
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee