f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe
Size 438KB
Sample260930-j2f2ks1crd
SHA256 f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074
MD5 9415d1eba5ac923bf8119b12c124c017
SHA1 a92484dc69f956c975287b05b3a12fd1c6fd7741
SHA512 be1440082e55a4f0995ad8a717f5d2a52e6b01609ca5135d619f74f5aee8c72b996da272e97ba6a47150f97bef3ee55861cc7ddb2c14a25a212296fa031898b2
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEz3:gV2/4x0NK6Sl+he8//gTT/dBEz3
TLSH
T14B943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3448	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
4784	EsetNupForward.exe
3448	EsetNupForward.exe
1356	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
5228	f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe
2344	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4784	EsetNupForward.exe
4784	EsetNupForward.exe
4784	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4784	EsetNupForward.exe
4784	EsetNupForward.exe
4784	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 2344	5228	f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe	85
PID 2344 wrote to memory of 4784	2344	EsetNupForward.exe	86
PID 3448 wrote to memory of 1356	3448	EsetNupForward.exe	92

C:\Users\Admin\AppData\Local\Temp\f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe
"C:\Users\Admin\AppData\Local\Temp\f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4784

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 d10a69b3da13d97ae5f66347b16637761f93518482c5067b032134e412f7b52e
MD5 931f1690d37fe38fcdfc4181ff1d4115
SHA1 ea41c07355657e1f42d229e54157a1396df5536d
SHA512 60101641d8659834c1ed7ab2986f14181fc8e1c9510d61929ab2df8f24dc223b1c4a0c79f1fa21ab45ca5180690f45704f0ca5ebc77bd02f4bc8c1cd7beb39e4
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEz8:gV2/4x0NK6Sl+he8//gTT/dBEz8
TLSH
T1F2943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe.swap.tmp

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe.swap.tmp
Size 438KB
SHA256 aaef53cc7eefa0fd2a3d629f41424f3b9103762553e21a6f4f8f09208f3cabd8
MD5 726016a2a9efe85fe2828f272fc64bfb
SHA1 258029958c79ba6c2ae30db0f1e3581d2112a7bc
SHA512 8130751961576356e908ddbfff8a6e98135da12738c652dc5be2ea4e52cd8e3036a2bf9e56b061e273894a39beceb15d12ab5e651c2552dba0551fffa4e8a45b
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzF:gV2/4x0NK6Sl+he8//gTT/dBEzF
TLSH
T17E943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 046321f0405de72487db1690aabfc9327329b6ffbc6c5f49d799897ef768611b
MD5 cab0fbd104d5187c547c66812024c943
SHA1 b9e990469d9c8f9a3a58b13c6b01ca8a257785d0
SHA512 df9a7becaf3cae45dedf0d5707f14e222d397642dd3e7085c07e4924d2ad95890354e2ceda20522bcaf57377d8558e9bd6b34dae56d73813e22a9d244477725f
TLSH
T169014C48D34B9E2B310550530295F31F98ECAC997B083F10FE9051C5D77800EE6D16A3
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 620251a0a18342c9ed454d35751879be0199d7069d9c48ca2b77e37fa14269c7
MD5 e1aa7a0acc98c0cc99644e225b666f61
SHA1 1a139bc12a2c3dee7704543ed50521ff20c91ff7
SHA512 5aee753800f45012d31108a8f10d302e54e33bc52f8aef95c3f9a23ab8583446548c09ab3206ab0fe3b8199118af57b8b47803611d5061ad3f490c577dcbe9e5
TLSH
T10C01F949A34A9A2B311550560595E22F98ECAC99BB483F14FE9051C9D77800EEAD16A3
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 69B
SHA256 f477449a8f002268d0887869c2989e908ecad56b9e653e0745564830c119e67c
MD5 bd1bed328be43af2c02e9cc520093ca9
SHA1 1b02a04788c6ee04222797bc90c45e7762c53630
SHA512 26fac0e75c82e3ba855882a4c5f59c218a77150c376ef3e0cf7fb90ecea0ad758189a0b94876e7e200b735d1a0bc3166bb47a48e3760af3c923266a8b7f0a82b
TLSH
T156A002993505300922A60044291A993356ECED59DB554D5D3DC1A8BDC7B43095EC8457
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1356-22-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/2344-8-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3448-21-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4784-23-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5228-5-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads