Overview

overview

8

Static

static

3

OctopusEAX.exe

windows10-ltsc_2021-x64

8

OctopusEAX.exe

windows10-2004-x64

8

OctopusEAX.exe

windows11-21h2-x64

8

OctopusEAX.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    76s
  • max time network
    65s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 13:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OctopusEAX.exe
  • Size 1.4MB
  • Sample261024-qxl6csvsht
  • SHA256 6c1758ea8aff65a6f69bfab05752a343077bdffae6873ac1d83dbaa00dc1fc19
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 32 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
    "C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3296
    • C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Query /TN "OctopusEAX"
      2⤵
        PID:3780
      • C:\Windows\system32\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query /TN "MasonEAX"
        2⤵
          PID:5648
        • C:\Windows\system32\tar.exe
          "C:\Windows\system32\tar.exe" -xf "C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Driver_Pack.zip" -C "C:\Users\Admin\AppData\Local\OctopusEAX\vbcable"
          2⤵
            PID:3076
          • C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Setup_x64.exe
            "C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Setup_x64.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:2144
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x0000000000000504
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:928
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{447ba4bc-62d1-e947-9df6-b33d5defffb0}\vbmmecable64_win10.inf" "9" "412cfd737" "0000000000000184" "WinSta0\Default" "0000000000000188" "208" "c:\users\admin\appdata\local\octopuseax\vbcable"
          1⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:2400
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\vbmmecable64_win10.inf_amd64_dd707570a4bf06fd\vbmmecable64_win10.inf" "oem1.inf:c14ce8840c48fa1f:VBCableInst.NTamd64:3.3.1.7:vbaudiovacwdm," "412cfd737" "0000000000000194" "e85f"
          1⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:3524

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              VBCABLE_Driver_Pack45[1].zip
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HVHEOQ6K\VBCABLE_Driver_Pack45[1].zip
              • Size 1.3MB
              • SHA256 b950e39f01af1d04ea623c8f6d8eb9b6ea5c477c637295fabf20631c85116bfb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Cable[1].htm
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QG8FQWMQ\Cable[1].htm
              • Size 31KB
              • SHA256 84a594b9987374a6816740a465dc75885fe1380753ee870089bdf595405289b7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VBCABLE_ControlPanel.exe
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_ControlPanel.exe
              • Size 908KB
              • SHA256 f5b44706fe7ba2eed0516dee791f826dc7a9891e997f6ce9704e2899300b14ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VBCABLE_Setup_x64.exe
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\VBCABLE_Setup_x64.exe
              • Size 915KB
              • SHA256 734c35dfa6d98f48782a451633ceb471166ec70d60482fd89a1123d0ee3c4f41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pin_in.ico
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\pin_in.ico
              • Size 7KB
              • SHA256 934865449455103c1c5997d8220acd160c3891f8a870f8e745b743d12681ac42
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pin_out.ico
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\pin_out.ico
              • Size 7KB
              • SHA256 e8728a811e1f1af7d2ba31f77e47d449d5bba091e3e89a0df325ac7a3e67652c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vbMmeCable64_win10.inf
              • Path C:\Users\Admin\AppData\Local\OctopusEAX\vbcable\vbMmeCable64_win10.inf
              • Size 11KB
              • SHA256 61c857be74831cc299d9be62f8d49d137f14063454fc54f859d5bc9b4b813daf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vbmmecable64_win10.inf_amd64_dd707570a4bf06fd.ini
              • Path C:\Windows\System32\DriverStore\FileRepository\vbmmecable64_win10.inf_amd64_dd707570a4bf06fd.ini
              • Size 468B
              • SHA256 8906cd166956981eae05cd5161392ead5ce768280836eb39a25ac11fc23963da
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              VBFFD5~1.SYS
              • Path \??\c:\users\admin\appdata\local\OCTOPU~1\vbcable\VBFFD5~1.SYS
              • Size 137KB
              • SHA256 f01344602472f1b527de5ee98f18987c03db48fea444e457d061e937f1d531d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vbaudio_cable64_win10.cat
              • Path \??\c:\users\admin\appdata\local\octopuseax\vbcable\vbaudio_cable64_win10.cat
              • Size 12KB
              • SHA256 0a921ebadbe39cf3fa7c14ff37d1ca22565a9651244bd3ac177dc810bc99072e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download