Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 06:39
Behavioral task
behavioral1
Sample
netstumblerinstaller_0_4_0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
netstumblerinstaller_0_4_0.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target netstumblerinstaller_0_4_0.exe
- Size 1.3MB
- Sample261023-hexv5swzb1
- SHA256 f3caa479809e3fa7cf4e71e75c63075ec53bc69343500b178edce4b9e3c6f384
- MD5 86e7586e4e45444f23ef2b71e2a93bfb
- SHA1 f61b0f2f6b59c46a59984a316c34282e3c936a8a
- SHA512 01980eb9c871506f7ef3db721275053fbf859b52656939df3d8a2efe44b7ea3d230cd6e54fb18f9d325bc0063ced6e0918099fc0682913aefcda6f80baa050d8
- SSDEEP 24576:kC9g4JTxVha/fH2t/dt3lvzcxPXdZ4VpwkAXT1Tcw0P2N9H0/:qUVsf2vtVvzcxX4wkApwwC2N9H0/
- TLSH T1AE553324F9D09E97C6E03473D978D07BD26A4906D6446B5BA2C90FBBBDEB7CA1100F18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\nsndis50.dll netstumblerinstaller_0_4_0.exe File opened for modification C:\Windows\SysWOW64\msvcr71.dll netstumblerinstaller_0_4_0.exe File created C:\Windows\SysWOW64\msvcr71.dll netstumblerinstaller_0_4_0.exe File opened for modification C:\Windows\SysWOW64\mfc71.dll netstumblerinstaller_0_4_0.exe File created C:\Windows\SysWOW64\mfc71.dll netstumblerinstaller_0_4_0.exe File opened for modification C:\Windows\SysWOW64\nsndis5.sys netstumblerinstaller_0_4_0.exe File created C:\Windows\SysWOW64\nsndis5.sys netstumblerinstaller_0_4_0.exe File opened for modification C:\Windows\SysWOW64\nsndis50.dll netstumblerinstaller_0_4_0.exe - Drops file in Program Files directory 25 IoCs
description ioc Process File created C:\Program Files (x86)\Network Stumbler\ns-signal-2.wav netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-signal-4.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\ns-signal-5.wav netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-signal-6.wav netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-aos-new.wav netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-gps-err.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\ns-gps-err.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\NetStumbler.exe netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\netstumbler.chm netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\netstumbler.chm netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-signal-3.wav netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-signal-5.wav netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-signal-1.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\ns-signal-1.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\ns-signal-3.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\ns-signal-4.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\ns-signal-6.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\ns-aos-new.wav netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-los.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\ns-los.wav netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\NetStumbler.exe netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\uninst.exe netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-signal-0.wav netstumblerinstaller_0_4_0.exe File created C:\Program Files (x86)\Network Stumbler\ns-signal-0.wav netstumblerinstaller_0_4_0.exe File opened for modification C:\Program Files (x86)\Network Stumbler\ns-signal-2.wav netstumblerinstaller_0_4_0.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netstumblerinstaller_0_4_0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hh.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ netstumblerinstaller_0_4_0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ netstumblerinstaller_0_4_0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ netstumblerinstaller_0_4_0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ netstumblerinstaller_0_4_0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ netstumblerinstaller_0_4_0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ netstumblerinstaller_0_4_0.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2696 hh.exe 2696 hh.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2696 2372 netstumblerinstaller_0_4_0.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\netstumblerinstaller_0_4_0.exe"C:\Users\Admin\AppData\Local\Temp\netstumblerinstaller_0_4_0.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\hh.exehh.exe "mk:@MSITStore:C:\Program Files (x86)\Network Stumbler\netstumbler.chm::/readme.html"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Network Stumbler\NetStumbler.exe
- Size 548KB
- SHA256 2d00eaffeb4618932e98ae1be298a38a0b6a9297c044af6094a9a0cb355b2356
- MD5 5ef079e5d178cb4ca7f2c904465edf36
- SHA1 aaa97acce14d85908b1684196930820c768b4b72
- SHA512 ad705430db2544da741fc22a4f9853bc781f3e2b71d675315d21ed9284ff2a5c3c29e4ec69e8ccb98b0d15782f81e00c66475ba6b2542d664df6c903b77588d5
- SSDEEP 12288:dUQ42XKmYOYml9j9nmrjzTt2qD5kP1Q2Krt:9NCA9j9nWjzTtjD5owt
- TLSH T177C44946E75968D0DE69103908AE379624BAECA1DF2DBED77B84796F4831BC0953033C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Network Stumbler\netstumbler.chm
- Size 146KB
- SHA256 b18f6c2497663be5c48f8ce9760e929591c7ce410f4888ebcec4ebd255022b49
- MD5 279fb77dde16400f636d7b03cfc4a927
- SHA1 3afd991024ac8746e18b952bbd550fbee7b0f59e
- SHA512 b1a5082428b5c93d56c613b90fbd74b248413aada32b2f54ef69d834a1ccebcf651dacacffc1a2575f5aad28e5114765ba64fee111de75db037abd92f7e92f34
- SSDEEP 3072:/zwKe3pXHvQSJWlzPmqYbWJSFrO3aZuozjtXb1USCQq2MDUR/Yg:/zwKe3pXHvXWlzeRiYsroQSNq9I/Yg
- TLSH T188E31250B9787D47C34FC5B17FB6A99EAAC91F80D9D40B39AC5C7DB1D5922C80050CAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat
- Size 8KB
- SHA256 e8a7a1830099366ff8ea31aee13fe54446373a291d59f272ca70c5ff7e6d13ba
- MD5 a0347ca980d5ff2d301705b29cdf623e
- SHA1 7534e941b37150e22f2bef1ab4c050223f2ff63c
- SHA512 6ece72b254eca352eb5a4412b6962a9c906bd8ca3179100b8ae6ba8dadb9d6218645aec71136d24bda1ab2b865cf3885c87e6a49bd88a010d814aee1850f8ce1
- SSDEEP 12:Zm6ysNMqiNMvyc0Ke0l6eohI+KKe+KjK9zh+KlE/KlEvt+KlEvdX:Dx5yc0JQ1V2FlEClEvt1lEvdX
- TLSH T104026D3072208120E00D8B37FFDA958B75247D42AE94851B300EF75E45B9E0E5BB09EE
- MD5 SHA1 SHA512 SSDEEP TLSH