60beaf2bfd5edf2318a470baefbfd3aba99e1bbcd93b92df9cc7942320051ea4

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OctopusEAX.exe
Size 5.0MB
Sample261104-xp52tstygx
SHA256 60beaf2bfd5edf2318a470baefbfd3aba99e1bbcd93b92df9cc7942320051ea4
MD5 83c0c35bda2adadcffeda75ed3b7f768
SHA1 7efc0f7f011dc17fdbc45949c8f6823eb4a6354d
SHA512 8fe4a6824c9a128ff5b9722ef2592d1ad08c7ade85fb54b43d319af98a4a63fe878581d230a5d11c772c8eb63e474208ffa3d32c8bdb5652153e69a650f4dcb8
SSDEEP 49152:cp2zJZo06yCzIZEnOjYlcy18rb2UJeAukPO:19A3AukP
TLSH
T11936D75AB6BA11D1D1BAC039D507562BED703096433C92FFA28189C52F707E8EE3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion persistence

Malware Config

Signatures

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	OctopusEAX.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	OctopusEAX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	OctopusEAX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	OctopusEAX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	OctopusEAX.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5028	OctopusEAX.exe
5028	OctopusEAX.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	264	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	264	AUDIODG.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1776	5028	OctopusEAX.exe	88
PID 5028 wrote to memory of 3732	5028	OctopusEAX.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
"C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
1⤵
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "OctopusEAX"
  2⤵
  PID:1776
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "MasonEAX"
  2⤵
  PID:3732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5028-0-0x00007FF703A60000-0x00007FF70412A000-memory.dmp

Download

memory/5028-1-0x00007FF703A60000-0x00007FF70412A000-memory.dmp

Download