Analysis
-
max time kernel
41s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 08:40
Static task
static1
Behavioral task
behavioral1
Sample
Octane_Injector.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Octane_Injector.exe
Resource
win10v2004-20240802-en
General
-
Target
Octane_Injector.exe
-
Size
704KB
-
MD5
5ee0fa66487080e85cde7ca26e09790d
-
SHA1
0724e0b4e49a1598ba38da914b113fef6649daf2
-
SHA256
7a311dd1a74b1e7fcc07d439ed0681cc4666802cd6b9d49efdae5c434b799021
-
SHA512
27c7bbb95f3f34354536cca03550b4fabb172b718184c1e55d98d7847a96d528d362143eb6fc042df8b7e7e9aae199652fb5dd5398b879b515e366339345bb02
-
SSDEEP
12288:qH/YJGsdbZ5CfW7wg79ro20/9toNc1jWYWhCIwLph0lhSMXlizNocCKbYVk:qf8bZHwI9ctFtoNc1jWYWhCIyh0lhSMa
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
IEXPLORE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000752677554af212cd4fd91314e3d13bb36f51785ce311169f500fe683a6e6957b000000000e8000000002000020000000f10f624443e9904f517770a8ee89f2fb5694b0682e28646f92a48e46d4b7bdab900000000c66b2b70304d8931e4fbe4c86e0514cd9fbdd82b02d54cc43295d57d0a2e5d97ffade38bc14ba85060d22083a031c8fa11e6d2cd50773008d604fff617c4429134c9c389dafb6ebe7a5e60ec2b2e75405f1b435c01538e72e0f1fc84ff21ae5586be3fdce4a30066b990b4c9667761d9046a64933d522b7d575fdba94ed252e65c73401cadad91c0cf5d957d8fc5890400000006cd37da9bf18ac8c341b785eb0821aef8874ca9eb5742cc0ddf57d4231c73b22581d122dfeb361d98f93e5d0ec71d807b5c6431e98fbed23c5e94623399255f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC705AA1-8099-11EF-B692-6A8D92A4B8D0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400dd8d3a614db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000427e63898cb4216822a82a8af4156162c22405a526b8db0caccea46a9656d841000000000e800000000200002000000095ef3528ba9b28446088ee01f323bfb1508efadbfc9e2b1a5c92ac8a85c658c6200000004344d00b74a11b634a0cc9d1715d3cdfb4011cc7b98f2de0ff7b47e0a1c3157640000000ae052ee7cc9eb0fb4296e6030b6d6fc653d84080d9db10b859a5dd1e941e1a1ecca75ec8504f57f56e37047780c03304b9eca63471dc240197ae7050ad39f053 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1620 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1620 iexplore.exe 1620 iexplore.exe 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Octane_Injector.execmd.exeiexplore.exedescription pid process target process PID 2900 wrote to memory of 2116 2900 Octane_Injector.exe cmd.exe PID 2900 wrote to memory of 2116 2900 Octane_Injector.exe cmd.exe PID 2900 wrote to memory of 2116 2900 Octane_Injector.exe cmd.exe PID 2116 wrote to memory of 1620 2116 cmd.exe iexplore.exe PID 2116 wrote to memory of 1620 2116 cmd.exe iexplore.exe PID 2116 wrote to memory of 1620 2116 cmd.exe iexplore.exe PID 1620 wrote to memory of 2088 1620 iexplore.exe IEXPLORE.EXE PID 1620 wrote to memory of 2088 1620 iexplore.exe IEXPLORE.EXE PID 1620 wrote to memory of 2088 1620 iexplore.exe IEXPLORE.EXE PID 1620 wrote to memory of 2088 1620 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Octane_Injector.exe"C:\Users\Admin\AppData\Local\Temp\Octane_Injector.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start https://octane.lol/discord2⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://octane.lol/discord3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5816c12acc0318fa7a520870fa0b5e50b
SHA1fb90085443b8f5b194227a90bee3f9905794fd6c
SHA25615e1ad0b5303ec3ef53bab5d161cc13aa3d40baaa294c3bd109986c1355f3394
SHA512014250e2b7b82b6108d28d391d27da421c7decf9d7657f6d36b93fb2230e4fb11301977e97da9e5c547d5119117d7db993a1fbec290ba16ed0fce333c05e990b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5a2b8dfc46f47aea5c8d155ef74d68585
SHA15f95dc94f4eeeee7157bb6f9cda8781bbbdde1bc
SHA256616822ce32f8dab781857554368cf8d6b26c02c460a6eab1775ffa8d89c96ea4
SHA51242f781c45fd30f9839752048f9170b48b18251230b022d9fd0ab4de4f9308c5d56f0b7e5267352a1811784ffa7ff2563ea6f2303e5b63943b59f2637f07b7b94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD529c78c353ede92941804db781b4fb648
SHA13d47ef03767fc4c90196dea45229619bd874550a
SHA256223deab1e61bf3ffbdd811aba51d7e741923d4f2c49ae5cd28feb14cb209f0ea
SHA5127701b7aa28e960a8de5ac67e49347df2084929e902fd8bb4830d07c16ac34ac647d26ab6e8e441c3c0b417c31b9547aa86a29a3df1803765f73d236942fb3c69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5f96845f8eb164ae1c72ceb4bfe6e3228
SHA1d53f39084df83d79c58ed6341c9c4d029097ac1c
SHA2567ae22e640e36d4b7615cf31e40a4cdbc00881b35cd5260650841fb8291beefdf
SHA5123bc282e0443ca833e96a1b976325b8ac411a1768d37055b2ac42b66ef77b7bed1fba33c65357eb038b989c72779606c05d39e3babdff6ab5c1da8227ecf4dbf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD50d3de91dcd936fa7b40fa09ac4d5c895
SHA18c8cbcc31eb189cebcf697287af9e5b7dfb0bdaf
SHA2565a8e23c355f4039d63f48c07d8535aa5cb2d05081d4c23300fb044e020c0e6c9
SHA512531986c7de6d649ebe0bc6a89728a6b517c9bb6b2d991203e372370e1063b40ab4d036b9ee6f7b5239d18db2f3c13f65c0efda868b6b2c23398f7ec36a176748
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5a1868820488a78e39fb5f503c4b5df3c
SHA133d04b264b6dc454fd7c9c6b4bcfd43a809be1fd
SHA25679d521819aa3167f3218df783a394b1d6a7b1e4899d27ba96f32d11bfff22c63
SHA5123c83d83921c4790a4299ad341276d35697dd25a1459e1b7b4932e90f3c91d23b2979f4dd613c4fa262b7dc96e834ea0b284eef2091554cd9f35b8181c41f96c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5a0fa599778f483bc6c37aab6eb8cf653
SHA1c1750afeca315d70de2fbd0e66fe3468430ad8cc
SHA256563ed812ccbdf66c44bc2db189042caede4f87bb1162aa92a666ee467d61eca0
SHA512dce1e911ebbf9a43ed84d1cd10b917236d524d37cda0d4396558f52bffeccec9560fd7ff2c681d5668b30ef4d2f342dc6e9ada9a5e6fcd806469cce4da3dc16b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5a928d217f2a0c0b24519eb9166bb46ed
SHA17d02ee4c1bb0f650b8c3d5b2b04bb44a5471cfc8
SHA2565f43511f8a955827753883f7dfe6d9c6ba559dfab86e054e9f99b7b75511587f
SHA51227e635835b38854f371a8540da89487229441535902713712699fb1194e49d05cd9b423d90355f30ea4ea417a48020232843aca5c60dd83c89f776256857af9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD56f3749d5f1742938419b5b0893352946
SHA1c13c7525694d58a5bfff069dd1c8176d6b27e099
SHA256eb5a6a8232fe0e96848ed952470d0889763d647b747a5f383641e9d4f3d0929f
SHA5122622c34904027e1bfc078fc304e1999003b81076fdd9f804097c5c956d02b25d7d055bf3bd433610e43ec196c4ebed8c7098788feb14dc9154546645c167615a
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\85y7ywt\imagestore.datFilesize
24KB
MD519da37d5226b2b178e66e36bf2bf6bf5
SHA1f71bc85bf7babf0bbdf69165eea36653751b43b1
SHA2566b7f282bc1cb3774dfc4b899ba235e0f9b1be0814611d8eb0d775b7035fab33f
SHA512cddfe447344c2f1b3aacc8b6436379f168a897baa1a05ab88de9e1a53cf27375bbda9779c3d459483467bb1de29320416569c27788f6531192bebc3484d924d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\favicon[1].icoFilesize
23KB
MD5ec2c34cadd4b5f4594415127380a85e6
SHA1e7e129270da0153510ef04a148d08702b980b679
SHA256128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7
SHA512c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c
-
C:\Users\Admin\AppData\Local\Temp\CabE9D3.tmpFilesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Temp\TarE9D6.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b