Overview
overview
10Static
static
3nmap-7.99-setup.exe
windows10-2004-x64
4nmap-7.99-setup.exe
windows11-ltsc_2024-x64
4zenmap/lib...__.pyc
windows10-2004-x64
3zenmap/lib...__.pyc
windows11-ltsc_2024-x64
8zenmap/lib...rt.pyc
windows10-2004-x64
3zenmap/lib...rt.pyc
windows11-ltsc_2024-x64
8zenmap/lib...se.pyc
windows10-2004-x64
3zenmap/lib...se.pyc
windows11-ltsc_2024-x64
3zenmap/lib...bc.pyc
windows10-2004-x64
3zenmap/lib...bc.pyc
windows11-ltsc_2024-x64
10zenmap/lib...ze.pyc
windows10-2004-x64
3zenmap/lib...ze.pyc
windows11-ltsc_2024-x64
3zenmap/lib...le.pyc
windows10-2004-x64
3zenmap/lib...le.pyc
windows11-ltsc_2024-x64
3zenmap/lib...rt.pyc
windows10-2004-x64
3zenmap/lib...rt.pyc
windows11-ltsc_2024-x64
3zenmap/lib...ta.pyc
windows10-2004-x64
3zenmap/lib...ta.pyc
windows11-ltsc_2024-x64
3zenmap/lib...rt.pyc
windows10-2004-x64
3zenmap/lib...rt.pyc
windows11-ltsc_2024-x64
8zenmap/lib...bc.pyc
windows10-2004-x64
3zenmap/lib...bc.pyc
windows11-ltsc_2024-x64
3zenmap/lib...gs.pyc
windows10-2004-x64
3zenmap/lib...gs.pyc
windows11-ltsc_2024-x64
3zenmap/lib...me.pyc
windows10-2004-x64
3zenmap/lib...me.pyc
windows11-ltsc_2024-x64
8zenmap/lib...al.pyc
windows10-2004-x64
3zenmap/lib...al.pyc
windows11-ltsc_2024-x64
3zenmap/lib...__.pyc
windows10-2004-x64
3zenmap/lib...__.pyc
windows11-ltsc_2024-x64
3zenmap/lib...er.pyc
windows10-2004-x64
3zenmap/lib...er.pyc
windows11-ltsc_2024-x64
3Analysis
- max time kernel
599s - max time network
490s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
nmap-7.99-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
nmap-7.99-setup.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
zenmap/lib/python3.14/__future__.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
zenmap/lib/python3.14/__future__.pyc
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
zenmap/lib/python3.14/_aix_support.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
zenmap/lib/python3.14/_aix_support.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
zenmap/lib/python3.14/_ast_unparse.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
zenmap/lib/python3.14/_ast_unparse.pyc
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
zenmap/lib/python3.14/_collections_abc.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
zenmap/lib/python3.14/_collections_abc.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
zenmap/lib/python3.14/_colorize.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
zenmap/lib/python3.14/_colorize.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
zenmap/lib/python3.14/_compat_pickle.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
zenmap/lib/python3.14/_compat_pickle.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
zenmap/lib/python3.14/_ios_support.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
zenmap/lib/python3.14/_ios_support.pyc
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
zenmap/lib/python3.14/_opcode_metadata.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
zenmap/lib/python3.14/_opcode_metadata.pyc
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
zenmap/lib/python3.14/_osx_support.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
zenmap/lib/python3.14/_osx_support.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
zenmap/lib/python3.14/_py_abc.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
zenmap/lib/python3.14/_py_abc.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
zenmap/lib/python3.14/_py_warnings.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
zenmap/lib/python3.14/_py_warnings.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
zenmap/lib/python3.14/_pydatetime.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
zenmap/lib/python3.14/_pydatetime.pyc
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
zenmap/lib/python3.14/_pydecimal.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
zenmap/lib/python3.14/_pydecimal.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
zenmap/lib/python3.14/_pyrepl/__init__.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
zenmap/lib/python3.14/_pyrepl/__init__.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
zenmap/lib/python3.14/_pyrepl/pager.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
zenmap/lib/python3.14/_pyrepl/pager.pyc
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
General
- Target nmap-7.99-setup.exe
- Size 35.2MB
- Sample260628-ynwmfac12s
- SHA256 fda839f35d9f8f18a11670e17d0332ce9d05a3556c5a20e91b0b56c57774f611
- MD5 ab2854d90d342bc22ceb1d88b38736cd
- SHA1 88a591b2d1b7019d6f85686db82201ab07a38ae3
- SHA512 af07f61306ba6c4b41a553b03f7626b2566ad9ec3fee66d478aa7ae3d7634be3ef33913594725dd8242db252644747fcc757eb8aea95b07d45fe8879697ff647
- SSDEEP 786432:awhBLkfvX3EE713WeJXJC+fvHEFTAE729OJFE7AI:awhBC3Z79xXcmclAw2BJ
- TLSH T13B87334B301D6665D35437BEAAE3BC723627EB563146E30235CD234D0B7B21DD39AA22
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Nmap\scripts\wsdd-discover.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ftp-proftpd-backdoor.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ftp-vsftpd-backdoor.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-favicon.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-git.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\mrinfo.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\tns.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\data\favicon-db nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\data\jdwp-class\JDWPExecCmd.class nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\mcafee-epo-agent.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\teamspeak2-version.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\tls-ticketbleed.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\data\psexec\nmap_service.vcproj nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\bacnet-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-joomla-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-security-headers.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-vuln-cve2014-2129.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\nessus-xmlrpc-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ssl-heartbleed.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\xmpp-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\fcrdns.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\impress-remote-discover.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\mysql-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\realvnc-auth-bypass.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\dhcp6.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\knx.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\bitcoinrpc-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-robtex-reverse-ip.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\smtp-open-relay.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\sstp-discover.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\drda.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nmap.exe nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\licenses\LIBLINEAR-license.txt nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\licenses\OpenSSL-license.txt nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\firewalk.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\snmp-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\stun-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-config-backup.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\targets-ipv6-wordlist.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\vnc-title.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-date.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\cups-queue-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ftp-libopie.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\hadoop-secondary-namenode-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-vmware-path-vuln.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\nfs-statfs.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\rsa-vuln-roca.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\data\drupal-modules.lst nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\allseeingeye-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\broadcast-novell-locate.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\snmp-win32-software.nse nmap-7.99-setup.exe File opened for modification C:\Program Files\Npcap\install.log npcap-1.87.exe File created C:\Program Files (x86)\Nmap\scripts\http-auth-finder.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\imap-capabilities.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ip-geolocation-map-google.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\asn1.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\ipmi.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\tftp.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\licenses\PCRE-license.txt nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\banner.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ftp-vuln-cve2010-4221.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-vuln-cve2010-2861.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ip-geolocation-geoplugin.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\s7-info.nse nmap-7.99-setup.exe - Executes dropped EXE 1 IoCs
pid Process 4868 npcap-1.87.exe - Loads dropped DLL 7 IoCs
pid Process 5468 nmap-7.99-setup.exe 5468 nmap-7.99-setup.exe 5468 nmap-7.99-setup.exe 4868 npcap-1.87.exe 4868 npcap-1.87.exe 4868 npcap-1.87.exe 4868 npcap-1.87.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nmap-7.99-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npcap-1.87.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5468 wrote to memory of 4868 5468 nmap-7.99-setup.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\nmap-7.99-setup.exe"C:\Users\Admin\AppData\Local\Temp\nmap-7.99-setup.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\nsxC987.tmp\npcap-1.87.exe"C:\Users\Admin\AppData\Local\Temp\nsxC987.tmp\npcap-1.87.exe" /loopback_support=no2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4868
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsg2BFA.tmp\options.ini
- Size 2KB
- SHA256 5910669a8690774155e2cdba27f5418b276305327d9cdff357933c61e37f24cb
- MD5 75c43045c8f83cd22f55dcc76709529c
- SHA1 eacb586b4522b629dc94d187a066c821faa0beb8
- SHA512 821cd109cf7378fbc31caf006412b0e3fd342ecd9bec8bbc370052d591a78fbdb3e69e8d8d10363f67bce24c39fee5db19696b5df2d5feefd374e795bbc096bb
- TLSH T173415A133AF91428E0BAA54DEBF6843597383485582EC90FD1D10A0F4DE6A814A27BEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsg2BFA.tmp\options.ini
- Size 2KB
- SHA256 32f301f3e9f16442008155bd5d00d9afb4a7723fea30b51ae90f3648d4dd0ad9
- MD5 0cb56231710c91083b54c0b86b0fc3fd
- SHA1 9a7d9b61237de711b791f23f0f0bb79ec569750b
- SHA512 c007dbef64d6ad5560d76e4055ec6c517d8821618547254588cf32b1ba9615f1942a3122cf933278bb8bc3221bc7bdafafa10772d7c524d308fa91423f81f1d0
- TLSH T15A414A133AF96024F0AAA64CEBF6843597383485192EC94FD1D14A0F4DE5A818627FEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsxC987.tmp\InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsxC987.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsxC987.tmp\npcap-1.87.exe
- Size 1.3MB
- SHA256 142c234f09a9618d7cdc2c37f607d6fc06615fad5581f728b60d4ad659f906bd
- MD5 72ff4fd033852a4c0e2cb70bec4966b8
- SHA1 a0eeecbd3dd973853f868cb80a4c80252ee17d1a
- SHA512 bb3d95058daa7847785a7118896aebd068770dd3b7a16bc291fc595ee89059e34b064fe5daac54269d4042a107b2af260e7108111b563540623845919c2ffa45
- SSDEEP 24576:kyD/5zh/wN3x8jFy7VuREJOYEvB3WHCmRjoE/aADHUuhum+/hmXgCMeGMHSmWLKq:1qN3ajFKwEJ1LRjBHHRum+/hmrJq
- TLSH T1345523516E94D2B2D6BB5EF2AF32037BCFB7BC0276A0C64F2348C60C5D65946A60C791
- MD5 SHA1 SHA512 SSDEEP TLSH