Overview

overview

8

Static

static

3

OctopusEAX.exe

windows10-ltsc_2021-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    54s
  • max time network
    35s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    23/10/2026, 14:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OctopusEAX.exe
  • Size 1.4MB
  • Sample261023-rhphlset7q
  • SHA256 6c1758ea8aff65a6f69bfab05752a343077bdffae6873ac1d83dbaa00dc1fc19
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
    "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Query /TN "OctopusEAX"
      2⤵
        PID:2732
      • C:\Windows\system32\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query /TN "MasonEAX"
        2⤵
          PID:2124
        • C:\Windows\system32\tar.exe
          "C:\Windows\system32\tar.exe" -xf "C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Driver_Pack.zip" -C "C:\Users\Admin\AppData\Local\OctopusEAX\vbcable"
          2⤵
            PID:2344
          • C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Setup_x64.exe
            "C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Setup_x64.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:216
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x444 0x248
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3924
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
          1⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5032
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f8d1e341-301b-8244-a13d-146fb939aace}\vbmmecable64_win10.inf" "9" "412cfd737" "00000000000001C8" "WinSta0\Default" "00000000000001D8" "208" "c:\users\admin\appdata\local\octopuseax\vbcable"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:3816
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:VBCableInst.NTamd64:3.3.1.7:vbaudiovacwdm," "412cfd737" "00000000000001C8"
            2⤵
            • Drops file in Drivers directory
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:2092

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Cable[1].htm
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\34VKP72Q\Cable[1].htm
              • Size 31KB
              • SHA256 84a594b9987374a6816740a465dc75885fe1380753ee870089bdf595405289b7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VBCABLE_Driver_Pack45[1].zip
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JFI2Z1W7\VBCABLE_Driver_Pack45[1].zip
              • Size 1.3MB
              • SHA256 b950e39f01af1d04ea623c8f6d8eb9b6ea5c477c637295fabf20631c85116bfb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VBCABLE_ControlPanel.exe
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_ControlPanel.exe
              • Size 908KB
              • SHA256 f5b44706fe7ba2eed0516dee791f826dc7a9891e997f6ce9704e2899300b14ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VBCABLE_Setup_x64.exe
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Setup_x64.exe
              • Size 915KB
              • SHA256 734c35dfa6d98f48782a451633ceb471166ec70d60482fd89a1123d0ee3c4f41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pin_in.ico
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\pin_in.ico
              • Size 7KB
              • SHA256 934865449455103c1c5997d8220acd160c3891f8a870f8e745b743d12681ac42
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pin_out.ico
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\pin_out.ico
              • Size 7KB
              • SHA256 e8728a811e1f1af7d2ba31f77e47d449d5bba091e3e89a0df325ac7a3e67652c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vbMmeCable64_win10.inf
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\vbMmeCable64_win10.inf
              • Size 11KB
              • SHA256 61c857be74831cc299d9be62f8d49d137f14063454fc54f859d5bc9b4b813daf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VBFFD5~1.SYS
              • Path \??\c:\users\admin\appdata\local\OCTOPU~1\vbcable\VBFFD5~1.SYS
              • Size 137KB
              • SHA256 f01344602472f1b527de5ee98f18987c03db48fea444e457d061e937f1d531d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vbaudio_cable64_win10.cat
              • Path \??\c:\users\admin\appdata\local\octopuseax\vbcable\vbaudio_cable64_win10.cat
              • Size 12KB
              • SHA256 0a921ebadbe39cf3fa7c14ff37d1ca22565a9651244bd3ac177dc810bc99072e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download