Overview
overview
8Static
static
3ipscan-3.9...up.exe
windows10-2004-x64
7ipscan-3.9...up.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
8$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
899s - max time network
437s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 23:22
Static task
static1
Behavioral task
behavioral1
Sample
ipscan-3.9.3-setup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
ipscan-3.9.3-setup.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
General
- Target $PLUGINSDIR/modern-header.bmp
- Size 25KB
- Sample260803-3chnnassct
- SHA256 86ae7b376b2f9fd38c0a80133252aa4b6773eb487ec3e6261c45dbd5ee0e102a
- MD5 98a614ef17188b5a5f2f84fbfd72e0ca
- SHA1 dfc6e8ee9dd4ab648935a1729e6711a2542c1c60
- SHA512 586c382a1b6b10122093c2e8bb8815b133ccf3ec19b9512bcf7e7dff02ba07d4430fed552d3f94d508dfb8ef174b72ac97d21961b744e40b543b04a5ce74f037
- SSDEEP 768:fPYs/a/Y/eGSIEYVv5x9YYeyoYxeu/dYf4S00YEeSvdY3YBnYc1ezuY2YhDYoSh2:os/JGcVv6ZyAPVINe2xxVidjDmCU
- TLSH T168C230C9C11A312F9AC9A72B2F5D512BF3BDBCC369E9E4EB70503137893C49658156C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2576 mspaint.exe 2576 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2576 mspaint.exe 2576 mspaint.exe 2576 mspaint.exe 2576 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\modern-header.bmp"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4960