Overview
overview
8Static
static
3nmap-7.99-setup.exe
windows10-2004-x64
4nmap-7.99-setup.exe
windows11-ltsc_2024-x64
4zenmap/lib...__.pyc
windows10-2004-x64
3zenmap/lib...__.pyc
windows11-ltsc_2024-x64
3zenmap/lib...rt.pyc
windows10-2004-x64
3zenmap/lib...rt.pyc
windows11-ltsc_2024-x64
8zenmap/lib...se.pyc
windows10-2004-x64
3zenmap/lib...se.pyc
windows11-ltsc_2024-x64
3zenmap/lib...bc.pyc
windows10-2004-x64
3zenmap/lib...bc.pyc
windows11-ltsc_2024-x64
8zenmap/lib...ze.pyc
windows10-2004-x64
3zenmap/lib...ze.pyc
windows11-ltsc_2024-x64
8zenmap/lib...le.pyc
windows10-2004-x64
3zenmap/lib...le.pyc
windows11-ltsc_2024-x64
3zenmap/lib...rt.pyc
windows10-2004-x64
3zenmap/lib...rt.pyc
windows11-ltsc_2024-x64
3zenmap/lib...ta.pyc
windows10-2004-x64
3zenmap/lib...ta.pyc
windows11-ltsc_2024-x64
3zenmap/lib...rt.pyc
windows10-2004-x64
3zenmap/lib...rt.pyc
windows11-ltsc_2024-x64
3zenmap/lib...bc.pyc
windows10-2004-x64
3zenmap/lib...bc.pyc
windows11-ltsc_2024-x64
8zenmap/lib...gs.pyc
windows10-2004-x64
3zenmap/lib...gs.pyc
windows11-ltsc_2024-x64
3zenmap/lib...me.pyc
windows10-2004-x64
3zenmap/lib...me.pyc
windows11-ltsc_2024-x64
8zenmap/lib...al.pyc
windows10-2004-x64
3zenmap/lib...al.pyc
windows11-ltsc_2024-x64
3zenmap/lib...__.pyc
windows10-2004-x64
3zenmap/lib...__.pyc
windows11-ltsc_2024-x64
8zenmap/lib...er.pyc
windows10-2004-x64
3zenmap/lib...er.pyc
windows11-ltsc_2024-x64
8Analysis
- max time kernel
900s - max time network
463s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 02:54
Static task
static1
Behavioral task
behavioral1
Sample
nmap-7.99-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
nmap-7.99-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
zenmap/lib/python3.14/__future__.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
zenmap/lib/python3.14/__future__.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
zenmap/lib/python3.14/_aix_support.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
zenmap/lib/python3.14/_aix_support.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
zenmap/lib/python3.14/_ast_unparse.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
zenmap/lib/python3.14/_ast_unparse.pyc
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
zenmap/lib/python3.14/_collections_abc.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
zenmap/lib/python3.14/_collections_abc.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
zenmap/lib/python3.14/_colorize.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
zenmap/lib/python3.14/_colorize.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
zenmap/lib/python3.14/_compat_pickle.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
zenmap/lib/python3.14/_compat_pickle.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
zenmap/lib/python3.14/_ios_support.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
zenmap/lib/python3.14/_ios_support.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
zenmap/lib/python3.14/_opcode_metadata.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
zenmap/lib/python3.14/_opcode_metadata.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
zenmap/lib/python3.14/_osx_support.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
zenmap/lib/python3.14/_osx_support.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
zenmap/lib/python3.14/_py_abc.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
zenmap/lib/python3.14/_py_abc.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
zenmap/lib/python3.14/_py_warnings.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
zenmap/lib/python3.14/_py_warnings.pyc
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
zenmap/lib/python3.14/_pydatetime.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
zenmap/lib/python3.14/_pydatetime.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
zenmap/lib/python3.14/_pydecimal.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
zenmap/lib/python3.14/_pydecimal.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
zenmap/lib/python3.14/_pyrepl/__init__.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
zenmap/lib/python3.14/_pyrepl/__init__.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
zenmap/lib/python3.14/_pyrepl/pager.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
zenmap/lib/python3.14/_pyrepl/pager.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target nmap-7.99-setup.exe
- Size 35.2MB
- Sample260727-deacmavcqd
- SHA256 fda839f35d9f8f18a11670e17d0332ce9d05a3556c5a20e91b0b56c57774f611
- MD5 ab2854d90d342bc22ceb1d88b38736cd
- SHA1 88a591b2d1b7019d6f85686db82201ab07a38ae3
- SHA512 af07f61306ba6c4b41a553b03f7626b2566ad9ec3fee66d478aa7ae3d7634be3ef33913594725dd8242db252644747fcc757eb8aea95b07d45fe8879697ff647
- SSDEEP 786432:awhBLkfvX3EE713WeJXJC+fvHEFTAE729OJFE7AI:awhBC3Z79xXcmclAw2BJ
- TLSH T13B87334B301D6665D35437BEAAE3BC723627EB563146E30235CD234D0B7B21DD39AA22
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Nmap\scripts\bitcoin-getaddr.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-security-headers.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ncp-serverinfo.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\rpc-grind.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\rpcap-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\rsync.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\shortport.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\dns-ip6-arpa-scan.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-referer-checker.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ip-geolocation-ipinfodb.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\omp2-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\rsync-list-modules.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\targets-xml.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\telnet-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\netbios.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nmap-services nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\cassandra-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\couchdb-databases.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\sip-call-spoof.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\mqtt.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\packet.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\dpap-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\fcrdns.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-trace.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\profinet-cm-lookup.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\rmi-dumpregistry.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\servicetags.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\ftp-proftpd-backdoor.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\hbase-region-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-litespeed-sourcecode-download.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\mqtt-subscribe.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\realvnc-auth-bypass.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\rfc868-time.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\tor-consensus-checker.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\gps.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\README-WIN32 nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\db2-das-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-title.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-vuln-cve2017-5689.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\puppet-naivesigning.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\snmp-win32-services.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\data\ike-fingerprints.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\data\ssl-fingerprints nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\broadcast-pppoe-discover.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\couchdb-stats.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-auth-finder.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-coldfusion-subzero.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-config-backup.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-methods.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\http-vuln-cve2011-3368.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\redis-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\flume-master-info.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\mcafee-epo-agent.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\rsync-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\drda.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\target.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\zlib.luadoc nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\gopher-ls.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\irc-brute.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\targets-ipv6-multicast-mld.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\scripts\vulners.nse nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\dhcp.lua nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\nmap.luadoc nmap-7.99-setup.exe File created C:\Program Files (x86)\Nmap\nselib\nrpc.lua nmap-7.99-setup.exe - Executes dropped EXE 1 IoCs
pid Process 3492 npcap-1.87.exe - Loads dropped DLL 7 IoCs
pid Process 3312 nmap-7.99-setup.exe 3312 nmap-7.99-setup.exe 3312 nmap-7.99-setup.exe 3492 npcap-1.87.exe 3492 npcap-1.87.exe 3492 npcap-1.87.exe 3492 npcap-1.87.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nmap-7.99-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npcap-1.87.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3312 wrote to memory of 3492 3312 nmap-7.99-setup.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\nmap-7.99-setup.exe"C:\Users\Admin\AppData\Local\Temp\nmap-7.99-setup.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\nse4DCA.tmp\npcap-1.87.exe"C:\Users\Admin\AppData\Local\Temp\nse4DCA.tmp\npcap-1.87.exe" /loopback_support=no2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3492
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2412
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nse4DCA.tmp\InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
- MD5 cfc7c53e282b0a7c527e4ed091f17fcd
- SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
- SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
- SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
- TLSH T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse4DCA.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse4DCA.tmp\npcap-1.87.exe
- Size 1.3MB
- SHA256 142c234f09a9618d7cdc2c37f607d6fc06615fad5581f728b60d4ad659f906bd
- MD5 72ff4fd033852a4c0e2cb70bec4966b8
- SHA1 a0eeecbd3dd973853f868cb80a4c80252ee17d1a
- SHA512 bb3d95058daa7847785a7118896aebd068770dd3b7a16bc291fc595ee89059e34b064fe5daac54269d4042a107b2af260e7108111b563540623845919c2ffa45
- SSDEEP 24576:kyD/5zh/wN3x8jFy7VuREJOYEvB3WHCmRjoE/aADHUuhum+/hmXgCMeGMHSmWLKq:1qN3ajFKwEJ1LRjBHHRum+/hmrJq
- TLSH T1345523516E94D2B2D6BB5EF2AF32037BCFB7BC0276A0C64F2348C60C5D65946A60C791
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsrACB3.tmp\options.ini
- Size 2KB
- SHA256 0f89219cc2aaa6bcbf7dba038e72393f805fe065936c478a2e2f1faf4c863c08
- MD5 2ec388af8b627b8aefaa66f7c1dd5e3c
- SHA1 a44f276f0f374135953cf5b2a38c8f5b7fcb5f44
- SHA512 6ae89ee4480c5ed4bd946d7ac72b1eabf4e057022a0aa9a57756922b0bb7d37fcd7500257b9170ac19950a4113c32cf6b7e78378f5ff42bd2ee1ed93db901b7c
- TLSH T13D414C133AF95428E0BBA54DEBF6843597383445542EC90FD1D14A0F4DE6A814A27FEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsrACB3.tmp\options.ini
- Size 2KB
- SHA256 32f301f3e9f16442008155bd5d00d9afb4a7723fea30b51ae90f3648d4dd0ad9
- MD5 0cb56231710c91083b54c0b86b0fc3fd
- SHA1 9a7d9b61237de711b791f23f0f0bb79ec569750b
- SHA512 c007dbef64d6ad5560d76e4055ec6c517d8821618547254588cf32b1ba9615f1942a3122cf933278bb8bc3221bc7bdafafa10772d7c524d308fa91423f81f1d0
- TLSH T15A414A133AF96024F0AAA64CEBF6843597383485192EC94FD1D14A0F4DE5A818627FEF
- MD5 SHA1 SHA512 TLSH