f2b8f1519865483996c5a5bdbf5e188107a17a44970f6ca9ebcf90c10d0c97fa

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eset_nod32_antivirus_live_installer.exe
Size 10.5MB
Sample260704-g51jaaby21
SHA256 f2b8f1519865483996c5a5bdbf5e188107a17a44970f6ca9ebcf90c10d0c97fa
MD5 f05c3bb57d55d6e4a79ffb457a8af153
SHA1 bd69f3afe56d66b81b642a44e6bdc11a74d7a938
SHA512 6d10d305a7a42bd2c7d699599f800d806f185b722d7e08641af63b45d0259721814058b33343b152ac31002450f1ce1f43a275d17d00deac39e2cac67f30eafc
SSDEEP 196608:IYHIlu4JVNMJexoGLU5ULjjZOOBDs8yLJ7poRDK8zAQfmnpx+gKH:IYolu4JHuGvZOOhs8yVdGKQAQfAx+p
TLSH
T112B6232066AB4016EDA24630757C75320B39FD3097E469CF726CB556AB3A6C06F34B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	eset_nod32_antivirus_live_installer.exe

Executes dropped EXE 3 IoCs

pid	Process
4312	eset_nod32_antivirus_live_installer.exe
3532	acstest.exe
728	BootHelper.exe

Loads dropped DLL 7 IoCs

pid	Process
4312	eset_nod32_antivirus_live_installer.exe
4312	eset_nod32_antivirus_live_installer.exe
4312	eset_nod32_antivirus_live_installer.exe
4312	eset_nod32_antivirus_live_installer.exe
4312	eset_nod32_antivirus_live_installer.exe
4312	eset_nod32_antivirus_live_installer.exe
4312	eset_nod32_antivirus_live_installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eset_nod32_antivirus_live_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eset_nod32_antivirus_live_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acstest.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4312	4136	eset_nod32_antivirus_live_installer.exe	87
PID 4312 wrote to memory of 3532	4312	eset_nod32_antivirus_live_installer.exe	88
PID 4312 wrote to memory of 728	4312	eset_nod32_antivirus_live_installer.exe	89

C:\Users\Admin\AppData\Local\Temp\eset_nod32_antivirus_live_installer.exe
"C:\Users\Admin\AppData\Local\Temp\eset_nod32_antivirus_live_installer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\eset_nod32_antivirus_live_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\eset_nod32_antivirus_live_installer.exe" --bts-container 4136 "C:\Users\Admin\AppData\Local\Temp\eset_nod32_antivirus_live_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\acstest.exe
    "C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\acstest.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3532
- - C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\BootHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\BootHelper.exe" --watchdog 4312 --product "ESET Live Installer" 19.0.3.0 1033
    3⤵
    - Executes dropped EXE
    PID:728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NSF45B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\NSF45B5.tmp
Size 251B
SHA256 0ab41793223136a42368e6ac4ec358567d8faa895d8dded8866c4ffd7939004d
MD5 8da16b5b9fb130fa6e973afe5bf56ad8
SHA1 89c93d257f466bce3087e7a66a263c5f5f94d0cc
SHA512 33021360e76cca6cdba620ea543f21e29a0e74e245f9948d98d81cf81d50cacce321d6decae19ef187cc34043d48153be12f6119cd366abf2cb5e7049c6f2a9c
TLSH
T177D0957D091FEF9722F844C405D49C0C33A7037027735755C454E29C0779801A05D0BC
MD5 SHA1 SHA512 TLSH

Submit Download

NSF4605.tmp

Path C:\Users\Admin\AppData\Local\Temp\NSF4605.tmp
Size 232B
SHA256 c7314ec79760dd1c3ecc638b6f0ced687ca7725831bffcfab4f9ff7ba626eb6e
MD5 ba6bd491828e373d31d98b5e94cbf9f2
SHA1 251e1a14762c3c6366d2c4de19168a4c15ffc415
SHA512 fda9b50ef8b9b16742abc7c395fe88da54e85c3e5ac04489731b5eadc9b6f85097da52368c951bd27482ad37e7fbee29ef4e80527d47d777967a39b1db0244d3
TLSH
T1D0D0971A18198D9323385AC300F6482CA3EA01E68B22208C95E82B4817B300A92183B8
MD5 SHA1 SHA512 TLSH

Submit Download

NSF4607.tmp

Path C:\Users\Admin\AppData\Local\Temp\NSF4607.tmp
Size 226B
SHA256 d895197657c045b1095abcd713c5bda6df1b48fe90cf3b2104ebe59033345a3e
MD5 0c0d8aaf3fa020fc15fa7117fa3aff15
SHA1 001794659b8bcf6a0315705554edd5278f1cfc92
SHA512 33ef058e77f5113531bb13aafd4b542d02bd23e412df663a800a23af4742e0ce2c850de2c41ba7335f0ca5c5b6e316bdb49a19b6b438130e70daa5b990cea9d4
TLSH
T13CD0978A0A068DA252381C8000C6043DA26A00E99B23E08881881786076200ED25C17C
MD5 SHA1 SHA512 TLSH

Submit Download

NSF4609.tmp

Path C:\Users\Admin\AppData\Local\Temp\NSF4609.tmp
Size 227B
SHA256 c5b8ece8c36b2198fe070802540b8fc22bfab64353758fbd1b48c1a8f5fffdea
MD5 1404ba40bd10465b012d792ca289a189
SHA1 aa7ea1cf872b339e094b33efe73df5b2f679c5c6
SHA512 9bf9517ceb4363e06348ed3039ef96b0243f59bf4d092732906fee4c7a638eca43786b5ff53f23b66a850beeff8423162e6770e0040ea411f61f3235bc6afedf
TLSH
T1B1D0972A2A298E5202782AC004D08A29F2AA80BC8B36200CC0A817D0873302CA368178
MD5 SHA1 SHA512 TLSH

Submit Download

NSF467B.tmp

Path C:\Users\Admin\AppData\Local\Temp\NSF467B.tmp
Size 227B
SHA256 82bf944e1662bd74872e73327ba86ca4549a6b28dfc70149abf17bcc0031c4ae
MD5 df3f4678fc00a056e6e767072e757a1b
SHA1 ab2fbe8ddfbc29219fdc4d9f8eb95a9e21357ef6
SHA512 e3e1bc6d7668c17ee03901edcfbe148fb7da22e5f62fee0a246de5110f510cc4373f7f12a8d11596796301fc26ef162df350df1da57dcd4f9171e34d76d47db6
TLSH
T12AD0A79D1D55CFB1527804C139B45D0C33BA42B1B7B225C994F8665C0271447614D53A
MD5 SHA1 SHA512 TLSH

Submit Download

BootHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\BootHelper.exe
Size 516KB
SHA256 e47f9359d3d383c5231a11b4062d44919b699e975c1f004e9f50684e3891be13
MD5 cab2c19af83fcf8a0145732183ff7b32
SHA1 00ead7bde15317f53736bed4fb9f34f585c51eab
SHA512 bafa7f3bb7dc7b598becf35ea534c4a7e1d89be5851250971650f15cd57b422b6653f91d91f3e87d7ee06f5dd630f2e137fd77d720c75ce2eb4b2dcc4c12ae39
SSDEEP 12288:ANO2A8xj8uidMHTiibZGRDBBg0EViWQVpEMF9FNd:A82AMmmmiw5gBV9OpE2x
TLSH
T10EB45B51B541C032E8A601319ABDDB7A5B3CAC300FE069CF73D47ABA59316C1A739B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acstest.exe

Path C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\acstest.exe
Size 18KB
SHA256 b33c79ee3b195ad49128806a19eaa3721d61cb337481265e0e7294864ee74259
MD5 0e78e89c9f55ad01b72f5be795b18795
SHA1 db93f175f2de8a322d4423ade18d99e4fbb23306
SHA512 fff2c95cacf269db0154ad6da779cffb49eb98b6c0e9212b49bc5f55f8fe0800d8198a50442a49c9dbac9157cd26784f22db21aae40cb7be147d714752696a7b
SSDEEP 384:irjjvfdG9057LvfdG9057zjSJv62X2Ip4pcqjdAA1m5wMvaSu7wCqbSeuGy:8lxOJh2Ip42qxf1mlv2Ux3y
TLSH
T176824BCB8A7C5103EE87AE70E3D8DA87BD7987C3ACA195A264DBD18004873D5F35912D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

em000_32.dll

Path C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\em000_32\1117\em000_32.dll
Size 236KB
SHA256 6eee2c5dd5ba422c3f4ff4f165f71dcd4e6a692d122302146727093d009aab63
MD5 93b4a308fea249919f26cf16d727f296
SHA1 5f88416ed35b6dcfd677bfc506e668d867a552f7
SHA512 1ccf68ed0106b01cdc30c79f3db7dce7bd6a453cb9bd3d0c72485338e04e1094fde24f2dca4a62b79c4322ad2da39c4c57196e125494f5de0aa48a54752ce8c6
SSDEEP 6144:EtmRDzAEEEE2VIqX7PwGkwFxiIkaaa4f5RahY:KmRDzAEEEE2VIqjwG7FxiIkaaam5RahY
TLSH
T12F347D2ABE450332D8E3C6719BDE59EAF33A602E136810D7709DE15417359E0A3BF2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

em024_32.dll

Path C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\em024_32\1168\em024_32.dll
Size 2.3MB
SHA256 340302a9c2ecf5190eaedf7a13fd25b373a50b04c366880c0828c9ef565b8588
MD5 1463206a306c2dd66cec1a05c852844e
SHA1 f9efefb966902c45903981ebb8826938997d958b
SHA512 80f1a520cc7292afd31e122a2212d2d147a4dbbe148e4c8011bd0149b6ab59008d5988f52588410aea5953c90e50c9947616127de59db060b2de94374f7fd3ce
SSDEEP 24576:npz9Ah6m5n0f5fdGRwss5Lz7QdBhr/I2t9p86UzR7+JzFVmEP3jEFrIYjo+B5:npzLKuPSBhr/JGRSJTsIY
TLSH
T1B5B5742DFB41B597C88208D050EB4667E47131B913FB6B825EC5CF66A8B43EA6338747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

em045_32.dll

Path C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\em045_32\1096\em045_32.dll
Size 4.0MB
SHA256 08fe1fefdb671e963a0833af9b954ebf3b0a1235aa72406ba647393441b07d39
MD5 01dffeb144420d7b5f3c7385cafec973
SHA1 8904d777c9d661590b906ab3f30a0937040e6cfa
SHA512 e6627362952f368eaab1a77598339df5f3ec609893785eeba06fedeef629756594544df765778344570f540e8b15f9b79ca274957e1f5b718e077889c686ffde
SSDEEP 49152:ZMalGmJbrSiYYCMtJc8rbpVgQhTts72Qk1elgvV1wfv3fG4eYAUeSk4AxOW2LX0L:hbNCMtKgbpVTf1DvMvvGaAFOio6mF18l
TLSH
T1CE169D42FF1181A1E9CE01742B6627B7CE36123C232550D3D792AE64E9356E37239B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eset_nod32_antivirus_live_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\eset_nod32_antivirus_live_installer.exe
Size 2.4MB
SHA256 f8ddea8825f3f7fdbfc599d656fa49c39635b73549558ad2d82f593a266f93ec
MD5 1cd98c40058eaff7f2a583b7a00d0f45
SHA1 e9cf4511adfc6153df300f332ea084cd84e00335
SHA512 7ec2666aaf6440d1295b2007a5fbf719f22926d580695109e190a410bfd944ce55406b8711ba826e1af36eebb1706019c7d47194c2eebb46da41f3bbfb3d5a93
SSDEEP 24576:vGmCPRLxg6Vq/XFhqsc0QN6JLB3zfp5j+guq7V4zNBKQHSoz9BRXCh0lhSMXlHYV:29g6M/Xq5KFNjqtz9BRf38XLtJ7qJS
TLSH
T114C57C30BA95C432E4920570956DE7BB873A6D2A07E950CFE3C4BD6A38744D32736E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plgInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\plgInstaller.dll
Size 4.7MB
SHA256 53e14510c4009344d82d6eccf44d7ffc5a0e9693834d4dddf7cb6de13c8bf68c
MD5 1f84fdae56d9e837593a7caca5889f4b
SHA1 2d37ef27d1f5e8693568c3d44a5281a05660a21e
SHA512 c4c58ad803b6d97f15a6e7628b3286f993948a87b41588b915e250fb15b89f928eb87b8749b02c37a403603d6c9f189207afd3ffc214a840129cc17b87659837
SSDEEP 49152:D0d6FI7lkrH1LrIvCLl0vynwBLIlVYsgBupWe+DVoGvODa:OkrVQvaEAwargBTeGv
TLSH
T109360601A3FD4214F1F76B71AEB956A6493ABC62AB34C1CF724C165D4B30AD19A70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sciter-x.dll

Path C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\sciter-x.dll
Size 3.2MB
SHA256 27cf5584e53a2dca073047f50c6e74e0f54a11e9ea08d2eb976be362a100b6ae
MD5 8171c92f597f54f315b9310816df23aa
SHA1 086bd3cf3c86eab8f461a2aeef122fba30852b41
SHA512 732f3a20a180eb98d3294928e2aa4beec40f324a8a939429dbc5838bad6eb46ee61b8d0126eaea370d3a0246ede9c5a7792c99d5da872526dc90b7b8fdb95510
SSDEEP 49152:bJDF2SksbaqXDivhaL5kVD78DS9NPkJTBrtNWEFdxM3hu4TKFw66k214:xQsbLTiwa8295WrtNrdxM3hu
TLSH
T1F8E5AF217E83407AD46F0770C5AFA219D67FDA60077144CB6BE4EA4AEE305F676302A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.dll

Path C:\Users\Admin\AppData\Local\Temp\eset\bts.session\8b8c25df-715f-4076-adba-c3e6f1078fca\updater.dll
Size 1.5MB
SHA256 fe675db20b11a03362c9abcd6cca6427ef93cc1e8bc190da16f74e68eedeaa4f
MD5 1768aa801ca3a946d860ea69aaef8229
SHA1 08ed0e1c772649a3e35e1ac01c2ea7df677ffb1f
SHA512 4e40e2f3b0649deb1f1142441a2b9875811bc8d901a29b503d5ffa2339d0a9de9cd89e458c6a056140d12c929ed238b6486d01e129f890548e477654a9a1e4f5
SSDEEP 24576:smvPw0UYemJP1YJrssssqFzp+JmKulLLb07fY1VsLnCFYxZJFMnwyH/KP:s0UWJwssssq7+NulLnR/FYHJFNyH/KP
TLSH
T152759C31B905C822D55E0170A57DDEAF912CA9760B3480C7F3E8AD7E64741E3673AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads