Analysis
- user interaction
yes - max time kernel
269s - max time network
198s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 09:25
Behavioral task
behavioral1
Sample
install_octoplus_suite_1.6.7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target install_octoplus_suite_1.6.7.exe
- Size 66.9MB
- Sample260916-ld38basw4k
- SHA256 8b9381f280cd6e4eda5f03314b626c8152d0677cab769f9ec549e77e9c267577
- MD5 dc13332425b917a6be2bde842c6f052d
- SHA1 8485405dea5b0235eb6ceb52003e25eb31b64e49
- SHA512 585593e879226cb20bbc15174fe31f7ecca7e03ff0e421cf96d1406e90ed4e501678b0dbdf4d4ba20d2826f4f2dc629bd8c271412884e482c3e72d6a34e57ec3
- SSDEEP 1572864:7bSNGQiekHNuISJVjHnxQt0O4tjW5XLpQcyJubLJ:7zVbNuvH+v4BW5XLmtYLJ
- TLSH T196E733C5872EA436ECEBA13D005F43467158BF521D839259B54F82ECB3E2984E62B73D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
38.242.233.249
-
Port
21
-
Username
SamsungResources
-
Password
getResources
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation install_octoplus_suite_1.6.7.tmp - Executes dropped EXE 4 IoCs
pid Process 4344 install_octoplus_suite_1.6.7.tmp 1900 OCTOPLUSSUITE.exe 3304 OctoplusSuite.exe 5352 SeUpdater.exe - Loads dropped DLL 10 IoCs
pid Process 1900 OCTOPLUSSUITE.exe 1900 OCTOPLUSSUITE.exe 1900 OCTOPLUSSUITE.exe 1900 OCTOPLUSSUITE.exe 1900 OCTOPLUSSUITE.exe 3304 OctoplusSuite.exe 3304 OctoplusSuite.exe 3304 OctoplusSuite.exe 3304 OctoplusSuite.exe 3304 OctoplusSuite.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-VJJBI.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-J5VI0.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-Q7QD9.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-RDF41.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\res\is-C9B4K.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-EJH6C.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-Q5M4O.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-0GD53.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-6C0EL.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-UGU0E.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\DRIVERS\Sony_ADB_Drivers\64Bit_win_7_vista\is-LH0Q9.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-K2G0B.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-NC6ES.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-J88NL.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-EERI1.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\DRIVERS\USBFlash_driver\x86\is-TRO74.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-7HPPN.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-4UMBP.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\zte\is-4U11T.tmp install_octoplus_suite_1.6.7.tmp File opened for modification C:\Program Files (x86)\Octoplus\Octoplus_Suite\DRIVERS\ADB_Drivers\amd64\WinUSBCoInstaller.dll install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\DRIVERS\ADB_Drivers\is-DC1F8.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-OT0MM.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-ER3BH.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-JVS89.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-3VLBL.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\DRIVERS\USBFlash_driver\Amd64\is-D95VP.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-UGEP8.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\modems\is-3VDIV.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\modems\is-HACN4.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\is-7DG0G.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-6E4PI.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-4H96S.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-ELJOV.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-KKCK9.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\modems\is-ILMJB.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-8JIU4.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\res\is-I3L1V.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-EGU9U.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\zte\is-PCR8S.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\testpoints\is-JRQHF.tmp install_octoplus_suite_1.6.7.tmp File opened for modification C:\Program Files (x86)\Octoplus\Octoplus_Suite\DRIVERS\USBFlash_driver\Amd64\WdfCoInstaller01007.dll install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-K14DS.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-6D5SD.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-0UIE6.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-QGRKG.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\modems\is-K0QIK.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\SKIN\is-A1ESD.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\LANGUAGES\is-VCSH7.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-0RDSL.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-GJMH9.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-F28AT.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-NLQA3.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\testpoints\is-D79M4.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-IR79U.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-NE10S.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-CA5LO.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-LFLP1.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\is-C55UE.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\Alcatel\is-JDE9H.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\testpoints\is-F4H3C.tmp install_octoplus_suite_1.6.7.tmp File opened for modification C:\Program Files (x86)\Octoplus\Octoplus_Suite\unins000.dat install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\DRIVERS\USBFlash_driver\is-GB4FB.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-2NTML.tmp install_octoplus_suite_1.6.7.tmp File created C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\is-GQKMM.tmp install_octoplus_suite_1.6.7.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OctoplusSuite.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SeUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install_octoplus_suite_1.6.7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install_octoplus_suite_1.6.7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCTOPLUSSUITE.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x0000000000415000-memory.dmp innosetup behavioral1/memory/2328-9-0x0000000000400000-0x0000000000415000-memory.dmp innosetup behavioral1/memory/2328-1152-0x0000000000400000-0x0000000000415000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4344 install_octoplus_suite_1.6.7.tmp 4344 install_octoplus_suite_1.6.7.tmp 1900 OCTOPLUSSUITE.exe 1900 OCTOPLUSSUITE.exe 3304 OctoplusSuite.exe 3304 OctoplusSuite.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5352 SeUpdater.exe 5352 SeUpdater.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5648 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5648 taskmgr.exe Token: SeSystemProfilePrivilege 5648 taskmgr.exe Token: SeCreateGlobalPrivilege 5648 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4344 install_octoplus_suite_1.6.7.tmp 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe 5648 taskmgr.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1900 OCTOPLUSSUITE.exe 3304 OctoplusSuite.exe 3304 OctoplusSuite.exe 1900 OCTOPLUSSUITE.exe 1900 OCTOPLUSSUITE.exe 1900 OCTOPLUSSUITE.exe 3304 OctoplusSuite.exe 3304 OctoplusSuite.exe 3304 OctoplusSuite.exe 5352 SeUpdater.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2328 wrote to memory of 4344 2328 install_octoplus_suite_1.6.7.exe 84 PID 4344 wrote to memory of 1900 4344 install_octoplus_suite_1.6.7.tmp 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\install_octoplus_suite_1.6.7.exe"C:\Users\Admin\AppData\Local\Temp\install_octoplus_suite_1.6.7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\is-GGNS8.tmp\install_octoplus_suite_1.6.7.tmp"C:\Users\Admin\AppData\Local\Temp\is-GGNS8.tmp\install_octoplus_suite_1.6.7.tmp" /SL5="$B01F2,69726921,57856,C:\Users\Admin\AppData\Local\Temp\install_octoplus_suite_1.6.7.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Program Files (x86)\Octoplus\Octoplus_Suite\OCTOPLUSSUITE.exe"C:\Program Files (x86)\Octoplus\Octoplus_Suite\OCTOPLUSSUITE.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
-
C:\Program Files (x86)\Octoplus\Octoplus_Suite\OctoplusSuite.exe"C:\Program Files (x86)\Octoplus\Octoplus_Suite\OctoplusSuite.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3304
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5648
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3932
-
C:\Program Files (x86)\Octoplus\Octoplus_Suite\SeUpdater.exe"C:\Program Files (x86)\Octoplus\Octoplus_Suite\SeUpdater.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\AdbWinApi.dll
- Size 94KB
- SHA256 86c563196176bb8581b9f359ac655e02e502edf324cd36bc6fffce87bff394ae
- MD5 98528e01bf7d946a3164b025f4509763
- SHA1 1c4402ce43ca738b67191a0e127909269846fdc1
- SHA512 a43ef61555ecff6ac5d43e8287f9a306960fd3ad6ebd20cf308be1e4844ebb451f9ad4eaa39c475a6a075ffe03945118b5393f23b2d7856fe39317c08c5f0af5
- SSDEEP 1536:cpCxybY0FS6MqS6WvgD9xj03TabrFvY5J6sCGt:cpo0k6ZWVTaif6sCG
- TLSH T192935A313891C072D8D272B949ECF765A27EE4A00B659AD3379803DEDD643D26E3538B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\AdbWinUsbApi.dll
- Size 59KB
- SHA256 dd3b857230408b0b8b0f6ea86fcb2f5db6a0b8c49efdc8e8e5a0a4da5fe268ee
- MD5 33ea376663cef03c174849e4cd33bd2d
- SHA1 6bc8cb1859a67b59b27d1d802be51cc23296be88
- SHA512 4353d17a039e66d730debc6d8693dade4f565a9d876830b5a247c86e587f4e84df3783516bc27083814be3e375bfb0b058c9963ac2739870de1d5ece341885c9
- SSDEEP 768:hLNk0yiFYWkgALpW+QvSugX0wUepQNXTQXdF+Q+An70edrqqOkIW:oyY8wugEwOVEXdz70e4gI
- TLSH T124535B2279D4C073C89251F909ADF762626FF6914B6084C3779813EE9E243D1AF3938B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\DRIVERS\USBFlash_driver\Amd64\is-AJ88C.tmp
- Size 1.4MB
- SHA256 749cc009f1cae5c633083897e906b381aa685829fee2d7cd5e07bae543848ff7
- MD5 0e9ad2d3784a0996a5131512939c09c0
- SHA1 f9de6ec1455b88f4e85c34c168e13a737da7aecb
- SHA512 e3b7e70289f24943bafc3eb503c73e6e10926b2231238feb813664d5f7d748815094294134bca9452c9c589695c0bd1f9a247b6cef4ff67bc1a8762482b28af0
- SSDEEP 24576:riSKT6VCRCracQNL2NwlBS34HtEnJJkIUTARiXCtW5XmSf/hBOpb+5LBIG:riSpqaOGwV4JJkIoA0XLm0POMD
- TLSH T1F665238093FC5065F0B69F36C2FA846066B1B8501E75C08F366AC95D1976FC8CAB4B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\DRIVERS\USBFlash_driver\x86\is-JJC6S.tmp
- Size 1.1MB
- SHA256 bcf6fbbdf1ad402dc761f87d79688c9b81aa70d63b835fc6618fc8e0686f39f4
- MD5 81d9bcceb78795cd0315b24960f2d130
- SHA1 a697a3d09e3f9d0ee69df229d14e7e9ae671829b
- SHA512 0107bab9c18d5227dfc8734f27b7f9ce4ada9e9c79f85ef85bcb80ebfae593b7d65a834ec3c3b50ef89a5f466eef98eb4ffddece907cb50f7261272b9482631c
- SSDEEP 24576:lqP9bArz7F+ET/IbCLvipNz0hOERdNhpjdESl/T:yArvbaN9E7Nz+4
- TLSH T17E352251A7EC4964F5F32FB19A7EA6922A7DBDD12E75C08E6248895C1830F84CC70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\LANGUAGES\Arabic.ini
- Size 136B
- SHA256 d517069bf9740bf5c0f37a464c123f446ccc23ae8fef967638438a5f457d79c6
- MD5 9772984e1be3bd52715a00f6acd6e617
- SHA1 f6ec76d71472f91b69853f0f15dfc940f9e6d36e
- SHA512 944ffb244138662d445360c8064fe86e889ec89cddea66b534439f74ad2e4e36ccee81de8bc3b2b369072c2237b74a98293a911f748734c9ae2b3cff24f975c4
- TLSH T173C09223F2C0610A9810E3D1CF8AC0FCBB10B11D008ED9AE84F0A90F58F041002024F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\LANGUAGES\English.ini
- Size 13KB
- SHA256 7f9ead76c6aee1a4c47e0c75eda916195c12bdf75a5e38ba75e1a3de61f9b613
- MD5 0e186b6c11b3f0521d1b32cdbe149eeb
- SHA1 4367ee344cf364646ae0f2603040f03cbee6b2cc
- SHA512 4d895acd074e1560944e1f98a28b8177886544d97d35358a38b369cf795d1ecaeb332881d3a22e1e41f3c21dad4ae202d775286e284ea2cafa736268caa6e14f
- SSDEEP 192:HovzgRnln1sWH3fyRmFydioTyxlUD0guZw4rlwBuqFLQNoVzc6JS9ki1WWnnw4J/:Ho6lMQivTEA0gg1ryBuqsmof9kUnn9B
- TLSH T15E52316363E95649FAF76F40EEB454B80B66BC96AC7CC16C51D0410A49F0E80E963BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\LANGUAGES\Hungarian.ini
- Size 140B
- SHA256 e8329e22b46301068192271da00bf6a910b3895af5ac208bb595552baf142d1f
- MD5 6cdbba7b33695ef9d9ebababe3107287
- SHA1 5f1f35c9e159b2652925c3938a25e6d405b8db47
- SHA512 944cd0d555f7f8763c9d4dcee1412ffc4124c132f667551b95a7f7c6e60807eff2e1c072359a1bf35057b12fd2c9fb2eafa4184df9da38640d35390f7495e763
- TLSH T1EBC04823A2C0204AAC22A3D1CE86C0F8BB11BC1C100E9AAE80E0A00F54F44100A020F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\LANGUAGES\Portuguese.ini
- Size 140B
- SHA256 a3daab31dd409f043f72df6c6fae60688fe2e6de54703dab3ac3514941e45172
- MD5 be109cb2ce7d9866ebd9725d5d14c2a3
- SHA1 37f10ea616f6b094bdcaf99464cb2dded905dfab
- SHA512 3a2e640e5e3964e5c6b262adac42bccf33dd1ee96cf34637cf70f1631e365334dcc11f14eaae5166ddd77c687e53a328c44432f04cfe89634755e84a43c34248
- TLSH T1DCC0922372D2200EA910E3E2CF86C0FCBB22B22D280EC9BE80F0A10F94F041053020F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\LANGUAGES\Romanian.ini
- Size 138B
- SHA256 7be21f90c9c0bfa5839b16e9dcfa5157e82c2fea81a850f0c0db75dd0a18fff1
- MD5 0cde01643a2ff6fecd47d9e236d3a6b7
- SHA1 9980875574f18012f4a3669e5e0b91075df57346
- SHA512 a13be5c747102a75c3b53f1a777daecfc8b995a1b7970dde521a4e5f007c0991383b0acdea3ddbd96e1d5b66c90d2790eb9a3c8c5232ca404a74be00abb60654
- TLSH T108C0922372D4214AAC22E3D2CEC6C0FCFB207C1C100EC9AF80E0A00F54F085002020F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\LANGUAGES\Spanish.ini
- Size 136B
- SHA256 379e1e0b395c026bf43b0eabd7ffe7af8ace08a473f369618b8d37432bbc3647
- MD5 5c2ba8e346ba970cce100a052e9928b8
- SHA1 28b356195d3cb0065105ab8e7da4bd4bc27a9953
- SHA512 5a854235147a086b0663c03e46c60074d932f7b5371edb0486a9798a4e1b7db867c8d604a6e244afde688090a566f86b52eb570d3ceaabdec35c65400520b567
- TLSH T167C0926372D4A20A9821A3E1DE86C0FCFB64721C000EC9AE80F0A00F95F041083121F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\LANGUAGES\Thai.ini
- Size 128B
- SHA256 e8defe9ef7ae7062df4fe560466fcd17328adf3228460bda1836c27e7aafc47f
- MD5 7456917a90a876182e87de7eba923b8d
- SHA1 cd747b440e5875e945ad216cbdb3a288404e4139
- SHA512 d266e292b9307c1fd26ce0b526e4b1aa50046df8e8f671442ad18b7c279dc77984a438109dd8cb67922c213727d03ce70206c95ec76fdb5d10dcc26906d53d75
- TLSH T184B0922372C4300A9800A3D1DE86C0FCBB10701C000FC9AE84E0A50F55F441402024F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\LANGUAGES\Ukrainian.ini
- Size 142B
- SHA256 1357fa83d018ddad0c9d9d981a25f305427e965105d4585bed123f466d00e9f0
- MD5 aba010b12237af283bbd5aa31f3cc61b
- SHA1 3d2c92ef86b511c153e5860a8601d8317374d40e
- SHA512 6889cbc02fcbdd9cf0dad3eb8ee516bc0894cf814a7c06ab566c6412a84384248150cfea9c712376d0c635ac22a8c0724d713533f64018c8ee68a1a13167608f
- TLSH T1A7C04823B2E0210AA800E3D69F86C0F9BB90741C000EA9AE84E0A00F54F04A552020F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\modems\is-34KCG.tmp
- Size 11KB
- SHA256 ee86040c7e639a0501fb61dacbeaaf8d0c19f09881f8af75f39378e4a6037347
- MD5 5d5393d609760951877e021ad35e4af8
- SHA1 c2e1683274cac43b2f22de88bf77b5881b48c6cc
- SHA512 f4ea19a18a0d124abdbc7f6497898ec6b271b5f778491df98cd498d4175f5d9e2cecfa297c7b6f17e6c97eb269f75972e7ee5142dfc6f94b15e026399398ef92
- SSDEEP 192:XSDS0tKg9E05TiB8sr3cVqR5J/fOijnsx6calNABwlcW0+qSf7N:CJXE05uJDcVqF2ilr3GW0yf7N
- TLSH T15C32C0FCE2701AD66D9574A2984D721BA3CA123D075823B15573FBF7441BE0A9F41191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\modems\is-AAIR3.tmp
- Size 26KB
- SHA256 abefe1e681e2775240c1db89db3d4e808c52d19117a98d08af14b2edf17638c9
- MD5 a4ca996b28d5d1167d504d087e902139
- SHA1 b80649e74cb78491c6623b002e00aa8a89dad9cd
- SHA512 5f24fc43df5993a21fbdb407ff016c03aabd95e57827c15249190875703984025544ab730d88a78ed6e9702b739db4e433a7c60f5790ec039442174c9877fac5
- SSDEEP 768:y35DfSaAljRWOlx8HAhrgdMBPpcYRjieMUDv9fi:Uol1Nlx02/c9eMUDc
- TLSH T168C2E1DA78B0654FBBB267609ED41B0CE732123C814E75492B9DA183C8916963F77C78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\modems\is-O5SVG.tmp
- Size 40KB
- SHA256 24bd2dff7cd0f4034b94f91bc43213235be6293cd70655d42c552ab55b65d392
- MD5 bb3eb2abe2a643f642d2241fb48b4048
- SHA1 8eb90741544342ce375952956dd2ece9fcd0b723
- SHA512 86bcc02316e9ce0811ea238e0d5d052312b2c9847061d9c70db9b6b8e760f26d2b233a7d734cc9460c0a004d6f3b0784906d4e28d0c18e81a5475b83a1c93e97
- SSDEEP 768:y35AqMg0embB8tMNJMv+SpdCJvH7LZvXU/25PSgGiPukjr+iMUGMxxzF:GWNpQ1vCJvHpvXU+5PS/PkjC18t
- TLSH T1CF1302A70DF839A5D7B7F2B61C601E4BAA26C213C480D668A5F23447241FEFD0A468DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\MANUALS\images\phones\zte\is-N89OR.tmp
- Size 31KB
- SHA256 81e49ff6a5117bf46ac4b7743a0524b9ffa6f1ab7df71cd195b0b79aaa9254f8
- MD5 880b247e636788f3b1e0870257848a61
- SHA1 343fee51409990b9397ace367ecfcdd8429a6744
- SHA512 652a7b95ec4f3d0c76cc0c1c0726c835920b8904b5a0642ea024d14821549ea594e06fc0d1489180b0b57735b343193ef2d7669561c5a079ba0c70f029e57d27
- SSDEEP 768:y353SFzML9SNFzUmGRPOd756Xa7+N8lXiss/U2tk:YSFzM5SNFkRPOd7Gcs/5k
- TLSH T1E9E2024DC670F895EA2D3E6728CD4B492B95423C1850CCFE6C12B0EE55DB5819F8DDE1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\OctoplusSuite.exe
- Size 36.1MB
- SHA256 899d3f24de9978caa32aabe39a080d1530a8dd7c2f3854c6cafe0b65950bf175
- MD5 3740f18c6959ccee472ae59c531f6e31
- SHA1 4b17e9220b2bc08d554d0739c46e3ff1d9a46dfe
- SHA512 952b481e463340245c4ea0587161e06905a48eb9e88a2be5a5e4c3fbe4618164abf67f26f7ad305612b9a468854a429feb8d20c6b7f9263d05d37f617668cc5e
- SSDEEP 786432:48+iCA6FGGP2FkLB6Oiz2bRtDqkYbznNFOxrlekpssZ:4TAUZD42bz3iznDOxoU
- TLSH T130873373119442CCF085D47E4963BDB772F11727E241B9BA736AA9CD203D868AB17CA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\RemoteService_Models.oct
- Size 242KB
- SHA256 882a443c290f7bcd35cfe7cd4de4da7cea554f98504eec14a9e36ad20fd54328
- MD5 ca0abb9b42e40130865b9eb5ff3ef54b
- SHA1 8a4f4af6c42e7bfa8aed7b69b6773b09313978d3
- SHA512 11da008ac8b34209773f103c8af77ad36c11186c6b65b2a1dc675363594cb5ac23315fdd49ac3ff5164474c5916e053dcc9c2102abc6f357e734a779b2462f9f
- SSDEEP 6144:oknZdHchkYrpvqiswr1d7zHhDb5JqywBUvFIval:oidHchRxDswBd7zBnq1UWval
- TLSH T1F034121A21BE9F7F83752774A83006639A28DE2CF98841DB00435FDB8777A859D6E707
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\SeUpdater.exe
- Size 8.5MB
- SHA256 982dbae918757853f3dbad9cb1773908f9864cce6f50f31db6065ce1f6396793
- MD5 12d1adfd08f6b964df8abdaef161cbc7
- SHA1 02c45787f5810dce6ec73beeecbb827d0dba2581
- SHA512 9b804d124ee8b2a1c5f2546b14f955de1cb157f1034ab178a777cb49603928f28cd38cc372fdfab2863cfe79cf79820bde7934db84c9e9392588eb74eccf2922
- SSDEEP 196608:ygz+lbX9pbzcQUkWDrJF6h8XDCMnYqelfeZqfZJKyGl:ygShQQUksr/6SxYqeUwRcZ
- TLSH T1F09633B7226532CDD4F2CD398937FCB2B1F5125F8982DCF98E5969C12A111A8E613B43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\libeay32.dll
- Size 1.1MB
- SHA256 b2f7887ae0bd418724eb32d3449197551a0895f2c764a933a7bd984f187eab78
- MD5 320fd1d9fc94e40cedcba3f9cc7aec43
- SHA1 38c830cbe05d4ef7a193bbf754a521c8f7a185c5
- SHA512 870df08bc60094edab701edafbac0e2d341e500e3d8dc418fadcd138e4cb59225e054f9fb571d35d4217968a16060dae06e7bb0407acbd51181098a486299f35
- SSDEEP 24576:PgOa+idPMVjzxbi2p/LajEe5aBpfXNCOK7bQ2mpoODMVIZmp:QUttnuIeQBdXNjKnQ2mpodVCmp
- TLSH T1DE45AD07B79198B2EC8E567E66B7567F0A379611432ACAC38FA039819C311D1A73F3C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Octoplus\Octoplus_Suite\meflash.dll
- Size 72KB
- SHA256 d027af2e7671ecab638b1a434f8c8289ed7f3fb014af7b8720c95e33964fced4
- MD5 1f825a69944a49d3687ed686dfce0194
- SHA1 a855658cf4163b0890551c5021ce559ff7409091
- SHA512 8b8bbfff6ddd3099a5713d303fdd218b1131623110e7cc6d473723eb77706d31714d4ea87c3b0686cc628c9d7170c63ee6a195fe22825b63dbd0e6272cdaec37
- SSDEEP 1536:D05Ofyn9ogvgK/atyTwq8NfS/eCHxXoThj:Nfyn9datPWesxXoThj
- TLSH T14F736E21F6E281F3C68E03703DA59F7B66BEBD540FE048839F65D66D0C316A1A53A247
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-GGNS8.tmp\install_octoplus_suite_1.6.7.tmp
- Size 697KB
- SHA256 cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
- MD5 832dab307e54aa08f4b6cdd9b9720361
- SHA1 ebd007fb7482040ecf34339e4bf917209c1018df
- SHA512 358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
- SSDEEP 12288:usMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0syxyR:JMcMoi3rPR37dzHRA6G7WbuSEmK50syQ
- TLSH T166E47D32F2A08837C1B32E789D1B82955936FD103E39B59776E91F0C4F796817A272D2
- MD5 SHA1 SHA512 SSDEEP TLSH