28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2

Analysis

max time kernel
298s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DeltaNet.exe
Size 2.3MB
Sample260930-en1rlsec37
SHA256 28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2
MD5 5d2a851492391161e22ec4de655ea1c4
SHA1 f7cca766d81fae6d50b211533e878d4decf70959
SHA512 2571cebbc018d8d8a51fa5574470e840eb64823f9c5d4cc41a89f9ae1f3c2c53fb7f76ac8c4b2b72988b5f33705654b164b0e62bd0c32998601cd2c647e35fb9
SSDEEP 49152:/HqMycZ3pHEueIJDvKRtx2rzgItSYIU6iU:/LytOJrr1Sn+U
TLSH
T1CDB56B03E795C4EAC49AC078C3579732BA72788A3720FDAB57D44A2C2E66BD05E1C717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4136	ngrok-daemon.exe
2964	ncat-daemon.exe
4100	osqueryd.exe
1568	firefox-service.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
8	pastebin.com
10	pastebin.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File created	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe
File created	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File created	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe
File created	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	firefox-service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	firefox-service.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DeltaNet.exe
"C:\Users\Admin\AppData\Local\Temp\DeltaNet.exe"
1⤵
- Drops file in Program Files directory
PID:3620

C:\Users\Public\ngrok\ngrok-daemon.exe
C:\Users\Public\ngrok\ngrok-daemon.exe
1⤵
- Executes dropped EXE
PID:4136

C:\Program Files\Nmap\ncat-daemon.exe
"C:\Program Files\Nmap\ncat-daemon.exe"
1⤵
- Executes dropped EXE
PID:2964

C:\Program Files\osquery\osqueryd.exe
"C:\Program Files\osquery\osqueryd.exe"
1⤵
- Executes dropped EXE
PID:4100

C:\PROGRA~1\MOZILL~1\firefox-service.exe
C:\PROGRA~1\MOZILL~1\FIREFO~1.EXE
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ngrok-daemon.exe

Path C:\Users\Public\ngrok\ngrok-daemon.exe
Size 2.3MB
SHA256 28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2
MD5 5d2a851492391161e22ec4de655ea1c4
SHA1 f7cca766d81fae6d50b211533e878d4decf70959
SHA512 2571cebbc018d8d8a51fa5574470e840eb64823f9c5d4cc41a89f9ae1f3c2c53fb7f76ac8c4b2b72988b5f33705654b164b0e62bd0c32998601cd2c647e35fb9
SSDEEP 49152:/HqMycZ3pHEueIJDvKRtx2rzgItSYIU6iU:/LytOJrr1Sn+U
TLSH
T1CDB56B03E795C4EAC49AC078C3579732BA72788A3720FDAB57D44A2C2E66BD05E1C717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download