826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe
Size 438KB
Sample260924-khc19awz4p
SHA256 826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c
MD5 625ef21918dbcd0d81f41868dedff62a
SHA1 9e9b27f61475522e8dffbed6c8a72083335a069c
SHA512 ecfe02fbf9f9ce03f01a85051943d839f542ee4965de2a9b89bcd93225f82c9a5e8d4f733a9bed93b68d3d1ac481d4c97f819e22ff3903d112627b8f9c314ce6
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzV:gV2/4x0NK6Sl+he8//gTT/dBEzV
TLSH
T13F943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5456	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
3424	EsetNupForward.exe
5456	EsetNupForward.exe
4712	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
5644	826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe
5452	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3424	EsetNupForward.exe
3424	EsetNupForward.exe
3424	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3424	EsetNupForward.exe
3424	EsetNupForward.exe
3424	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 5452	5644	826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe	89
PID 5452 wrote to memory of 3424	5452	EsetNupForward.exe	90
PID 5456 wrote to memory of 4712	5456	EsetNupForward.exe	93

C:\Users\Admin\AppData\Local\Temp\826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe
"C:\Users\Admin\AppData\Local\Temp\826b943e5b3466e0a1b100f5e3e9a7d3ebfbb8fe31e2a5362835b568e03dd68c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3424

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 fe406d76d0cf7b2d827e8fe4830d861c29f71c9b3676f2f8322aba33abe250e6
MD5 30cd3a2ce030bd54636632290e896133
SHA1 937436f54ca1d2597e9a7c4ef448123ce5c8c12c
SHA512 6e893ade3f6d28dbe663a8a8626af9df486078430a3a14194dca53f494c7fb6a3649f1cbb2469103c90d4c619688729043cd2609b8010c0425c0274c262054f2
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzu:gV2/4x0NK6Sl+he8//gTT/dBEzu
TLSH
T173943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe.swap.tmp

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe.swap.tmp
Size 438KB
SHA256 1ae7d52d4fd9696f3f1785759e27c1a081fc8f5a443e5bb2d11f89e78fd4c79d
MD5 a777555660efa1c0e5fa7d538604ed8a
SHA1 ae8fc69afe8f38e5619c47ddd40b3853a51712e1
SHA512 a9387e10857f87df76e9dee3f2ce88bc595bbeb99275a04efbf9e6729646cd2c1f40009ad2c64ca4256f96b6f018f3401eb8ef56891d363ac3ad797fc5b87b56
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzN:gV2/4x0NK6Sl+he8//gTT/dBEzN
TLSH
T1A1943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 a8ed2723e9117c9c64afa87c94bd1760720e8d745e978a3393c66d12cf4175f9
MD5 46b180ff9844c77107b8976baad6a2b4
SHA1 fb93b092304745da5a60add0adcd5e54c6ce4c41
SHA512 4f6c30c3684724ddea2aaca8869a15802da3caeafd20082c0f8c4832f84bc444e2799595d7e9c0f3596877750cfa9ce688744227cca6c7472b636a0379240711
TLSH
T1740170C9D1CB9A6F010564630197E11DE4ACAA99BB44BF24BF90D1C9C67802ED7F1663
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 9880ba1bd14c608c1e6b68fc2ee0529ab355421482276b622ea63e23e9870f4d
MD5 8fd2b6e9c3881b990cfbe9542b4b1c8e
SHA1 db1b790b53c1233bfe19f9e3b9ac072beee8d0fe
SHA512 e458049e796e4850a88967e884a49ccdf3657e9c0de086b22c8e7fc49940b2cd46f43284bbb9df49b53677e64d0449159c0f59c80aca4140cfbc3b0acb00165f
TLSH
T15D01BDC8E0CB9A2F01056062015BD01CA0ECAE98FB04BF14BF80D1C8C67802EDBF1A63
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 135B
SHA256 bf0e9fc470b3bf1cee8b3734b12aac0c04549ba493606ef8290982e6401ce22e
MD5 e77d1b5f1e5b02db5d6114c0c2aceeef
SHA1 605a02ad4c4f7a8e2d641595c0b48c07261e7f03
SHA512 eda4b3540f98a4b2aff4a935e09517521eacca678f0741afdd08184fbb024d4fd4159ae2edfd0b496da8b826888ef67c5a570f375ddfde7866eec60ce9d32399
TLSH
T140C02BC82401142F00C63004144E192005DCE684C7004D087FC0D06492A011489F0467
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3424-23-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4712-22-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5452-9-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5456-20-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5644-1-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads