826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe
Size 438KB
Sample260924-khc19awz4p
SHA256 826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c
MD5 625ef21918dbcd0d81f41868dedff62a
SHA1 9e9b27f61475522e8dffbed6c8a72083335a069c
SHA512 ecfe02fbf9f9ce03f01a85051943d839f542ee4965de2a9b89bcd93225f82c9a5e8d4f733a9bed93b68d3d1ac481d4c97f819e22ff3903d112627b8f9c314ce6
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzV:gV2/4x0NK6Sl+he8//gTT/dBEzV
TLSH
T13F943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1744	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
3452	EsetNupForward.exe
1744	EsetNupForward.exe
2500	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
4232	826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe
4984	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3452	EsetNupForward.exe
3452	EsetNupForward.exe
3452	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3452	EsetNupForward.exe
3452	EsetNupForward.exe
3452	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4984	4232	826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe	88
PID 4984 wrote to memory of 3452	4984	EsetNupForward.exe	89
PID 1744 wrote to memory of 2500	1744	EsetNupForward.exe	97

C:\Users\Admin\AppData\Local\Temp\826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe
"C:\Users\Admin\AppData\Local\Temp\826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3452

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 7d0b20f5f7986f573228fa8c643335696013870741b06364121969a46bc87fd5
MD5 a70e8f90052d7509a8a0f92b37f0bcee
SHA1 c6e367fbc5c2ebbdcebf33492ef24efc0e5bee5f
SHA512 57b43771d24c236e4f22850d7b369086dbbbbe4027a21c0e18d8bb12cc718573b65f15aa645ac13209774c3067667f2eb7d0b209d45a3d4b87fed7e3cdbf6848
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEz0:gV2/4x0NK6Sl+he8//gTT/dBEz0
TLSH
T121943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe.swap.tmp

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe.swap.tmp
Size 438KB
SHA256 1bc2a7a0598a17097554ae4178a5e4313739edc5892d42ba8ca7edb791ad7989
MD5 19ae5efd9fa943911d08fec2ad47ecd7
SHA1 ec0a5847ea71df1d76a77cc206af2c5678cf148d
SHA512 78242e28526d17688f91b1e3c404f6a13ac3105341c7b314456bd711de47e639e56b34278564d116caa72c5dbfe3ddd1f9277bef65f5e87f53ccc31a623662fd
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzZ:gV2/4x0NK6Sl+he8//gTT/dBEzZ
TLSH
T1E3943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 69B
SHA256 358e81e93a7e552198686a9e49f95888151f24949155685ec3c230457905ab47
MD5 3c35f9493233712fa408c4056dd19d77
SHA1 697c320422a03425adbd4f8c77620bd2829baece
SHA512 092c9281a0f48852cbcad66808b2d086ba682e34ecb30acca5fb8164391c3b18383a70b0b10fe1d4814f5dfd98ed336fa292a369ba092d0274c7be0754c28b4d
TLSH
T132A002D93445300D13B600446C1B983556ECEE59DB558D8D3E81E87DCB783196EC8457
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 b239bed84f495dbf545c994c07e0c753e3485b6e9816ada10fb7bec12789e9c7
MD5 a69cdb27ee87e7ff46aad78aba20f677
SHA1 1ff17aaddcef221f9c8f810ca8c3962fa7071428
SHA512 86173162403e07aedc7c5b0b51d7804122fbc3ffb1dd2b958cc1c22093bb098e89fedfba33a69e7f4bc7b61212eef257a8f78553ba68c99299dfb68e1be5c728
TLSH
T1F10149CDD1CB9A2F1101605205DA911C94ECAE98FB047F14BFC0D1C8C67802DDBD1AA7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1744-21-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/2500-22-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3452-23-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4232-1-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4984-8-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads