60beaf2bfd5edf2318a470baefbfd3aba99e1bbcd93b92df9cc7942320051ea4

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OctopusEAX.exe
Size 5.0MB
Sample261104-xp52tstygx
SHA256 60beaf2bfd5edf2318a470baefbfd3aba99e1bbcd93b92df9cc7942320051ea4
MD5 83c0c35bda2adadcffeda75ed3b7f768
SHA1 7efc0f7f011dc17fdbc45949c8f6823eb4a6354d
SHA512 8fe4a6824c9a128ff5b9722ef2592d1ad08c7ade85fb54b43d319af98a4a63fe878581d230a5d11c772c8eb63e474208ffa3d32c8bdb5652153e69a650f4dcb8
SSDEEP 49152:cp2zJZo06yCzIZEnOjYlcy18rb2UJeAukPO:19A3AukP
TLSH
T11936D75AB6BA11D1D1BAC039D507562BED703096433C92FFA28189C52F707E8EE3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion persistence

Malware Config

Signatures

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	OctopusEAX.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	OctopusEAX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	OctopusEAX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	OctopusEAX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	OctopusEAX.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1440	OctopusEAX.exe
1440	OctopusEAX.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4988	AUDIODG.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 5480	1440	OctopusEAX.exe	86
PID 1440 wrote to memory of 6084	1440	OctopusEAX.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
"C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "OctopusEAX"
  2⤵
  PID:5480
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "MasonEAX"
  2⤵
  PID:6084

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-0-0x00007FF6C5800000-0x00007FF6C5ECA000-memory.dmp

Download

memory/1440-1-0x00007FF6C5800000-0x00007FF6C5ECA000-memory.dmp

Download