a2f4ec1e5ea353ff67efd24b2ebf081ba44532410fae8d5e146af0310aa4f56b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
npcap-1.88.exe
Size 1.3MB
Sample260814-qyp9eaab39
SHA256 a2f4ec1e5ea353ff67efd24b2ebf081ba44532410fae8d5e146af0310aa4f56b
MD5 c78aaa2a95794030f71798c94f0da181
SHA1 35f6c49deefffbe51f96985e87e813ad68c1f217
SHA512 ce732beee69c3431268fe7ec51b99be338c8d5e963c009eda5a622d965fb91c3c3bc1ed071839f964c84a2cddf557d39272040036a6d51138ed8064aef282d08
SSDEEP 24576:Y2S1Qavd8udnTYXUIavMq/Zcw31W8PGFmlc4BbRfEra3Az:aXu0mii81XPyAbBbRuaQ
TLSH
T1AC55238896E8E81EF0B34E3728F0835E52BAB10A06E1D60F7350F55EF935B55C61C7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Npcap\install.log	npcap-1.88.exe

Loads dropped DLL 4 IoCs

pid	Process
6128	npcap-1.88.exe
6128	npcap-1.88.exe
6128	npcap-1.88.exe
6128	npcap-1.88.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npcap-1.88.exe

C:\Users\Admin\AppData\Local\Temp\npcap-1.88.exe
"C:\Users\Admin\AppData\Local\Temp\npcap-1.88.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx9543.tmp\InstallOptions.dll
Size 25KB
SHA256 04f9432186b2aaffe44cf9610ef3d148eff881880ceda6efa59b3cba1405b892
MD5 5f840911e4fc9015ce7a2fcb54dcaf5e
SHA1 589d1ad1c0e7c9a5454c2a5afab283e98b90f061
SHA512 53b62c5545e4378110d45355d4bf493caa40dc63167f86955752e43d93b96e4b9465578797a4a9b6fe107f76ed1816cf076a0be3e97d9f943c1c63ddf8142a37
SSDEEP 384:EKNt+4t7uJalUnGesY7Lt8nC3/YosaiIYi/kn/hy8RbmL4nNygB:EH4t7uJnGeXLtUJ+Yi/S5ALO
TLSH
T18CC27D527BD05C72E5A72E3479E0A227DFB1F6226881C987E2365E069B413813EBD361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx9543.tmp\System.dll
Size 22KB
SHA256 3ceadba8f202e3f7f605dcad341255e596810fc94d623de2b2c9169ff7bc4592
MD5 cd6a36dd894b5a4d5a09b14f8b4141c6
SHA1 e65bad79ac9c676f65a988afd779f72cc699430f
SHA512 ac1443f441e9e37604d7c13a4601debd06fc335aaa43a147d914c6940cffedd2d2075463f82b815861849c3f28c240d33b948442d981287958deb3174e212de0
SSDEEP 384:b/Qlt7wiij/lMRv/9V4brrzIYi/knoQy8RbmL4nNyj1+M:baeiijipo8Yi/k5AL/R
TLSH
T18DA28E138BA04CF1F9165D3034D4BA36AFBB79991AD081D377E6C191AB503C329BD297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx9543.tmp\options.ini
Size 2KB
SHA256 8f3f3698c1f54b5ee888cb4f3b9bdd1a3c70b960dae3e92dda823afc5993466a
MD5 8a82cd77c58fac7d7d93a2b0205c1d6c
SHA1 8387a6cac770c77347eb5b5f182b5f1b27e8e745
SHA512 d662b8139b1dac29fdd7fa792b14e23bd94bcb2036e94f6aff211885845973fcfb48d3fa4cb71d48358f891299bd9e712d60c8a8b45df05d118121956bb1235a
TLSH
T15F514C133AFA5428E0BAB549EBF6803597383445642EC90FD1D10A0F4DE6E814627BEF
MD5 SHA1 SHA512 TLSH

Submit Download

options.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx9543.tmp\options.ini
Size 2KB
SHA256 93fc81eb96efab8bea3189c10ced7f1b51ff1d1755d5b6e9702e743b875f85ba
MD5 a7e70015a583ae6360f817eb20a3cb30
SHA1 2f72ae336b7ec2594eb3c4d8ff61ba40c30874ce
SHA512 e6b6e698ab83a8549e80280fa4bf212b571e3e11b5e9d6d51cecdb5ec8249b444ec993dd2d7fcdf1de1e0e8e97c7948a2ac5bbe0ea1ac6e5be4fa78076d2639c
TLSH
T182413A133AF96024F0AAA64CEBF6843597383585192EC94FD1D14A0F4DE5A818627FEF
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads