28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2

Analysis

max time kernel
298s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DeltaNet.exe
Size 2.3MB
Sample260930-en1rlsec37
SHA256 28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2
MD5 5d2a851492391161e22ec4de655ea1c4
SHA1 f7cca766d81fae6d50b211533e878d4decf70959
SHA512 2571cebbc018d8d8a51fa5574470e840eb64823f9c5d4cc41a89f9ae1f3c2c53fb7f76ac8c4b2b72988b5f33705654b164b0e62bd0c32998601cd2c647e35fb9
SSDEEP 49152:/HqMycZ3pHEueIJDvKRtx2rzgItSYIU6iU:/LytOJrr1Sn+U
TLSH
T1CDB56B03E795C4EAC49AC078C3579732BA72788A3720FDAB57D44A2C2E66BD05E1C717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4708	ngrok-daemon.exe
3696	ncat-daemon.exe
3204	osqueryd.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File created	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe
File created	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe
File opened for modification	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File created	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe
File created	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DeltaNet.exe
"C:\Users\Admin\AppData\Local\Temp\DeltaNet.exe"
1⤵
- Drops file in Program Files directory
PID:2708

C:\Users\Public\ngrok\ngrok-daemon.exe
C:\Users\Public\ngrok\ngrok-daemon.exe
1⤵
- Executes dropped EXE
PID:4708

C:\Program Files\Nmap\ncat-daemon.exe
"C:\Program Files\Nmap\ncat-daemon.exe"
1⤵
- Executes dropped EXE
PID:3696

C:\Program Files\osquery\osqueryd.exe
"C:\Program Files\osquery\osqueryd.exe"
1⤵
- Executes dropped EXE
PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

osqueryd.exe

Path C:\Program Files\osquery\osqueryd.exe
Size 2.3MB
SHA256 28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2
MD5 5d2a851492391161e22ec4de655ea1c4
SHA1 f7cca766d81fae6d50b211533e878d4decf70959
SHA512 2571cebbc018d8d8a51fa5574470e840eb64823f9c5d4cc41a89f9ae1f3c2c53fb7f76ac8c4b2b72988b5f33705654b164b0e62bd0c32998601cd2c647e35fb9
SSDEEP 49152:/HqMycZ3pHEueIJDvKRtx2rzgItSYIU6iU:/LytOJrr1Sn+U
TLSH
T1CDB56B03E795C4EAC49AC078C3579732BA72788A3720FDAB57D44A2C2E66BD05E1C717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download