f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe
Size 438KB
Sample260930-j2f2ks1crd
SHA256 f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074
MD5 9415d1eba5ac923bf8119b12c124c017
SHA1 a92484dc69f956c975287b05b3a12fd1c6fd7741
SHA512 be1440082e55a4f0995ad8a717f5d2a52e6b01609ca5135d619f74f5aee8c72b996da272e97ba6a47150f97bef3ee55861cc7ddb2c14a25a212296fa031898b2
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEz3:gV2/4x0NK6Sl+he8//gTT/dBEz3
TLSH
T14B943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1920	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
5172	EsetNupForward.exe
1920	EsetNupForward.exe
3476	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
4484	f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe
5740	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5172	EsetNupForward.exe
5172	EsetNupForward.exe
5172	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5172	EsetNupForward.exe
5172	EsetNupForward.exe
5172	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 5740	4484	f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe	88
PID 5740 wrote to memory of 5172	5740	EsetNupForward.exe	89
PID 1920 wrote to memory of 3476	1920	EsetNupForward.exe	92

C:\Users\Admin\AppData\Local\Temp\f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe
"C:\Users\Admin\AppData\Local\Temp\f60ecdf74b0b0eee046f471687369a97e79e1840e51f220a75d6e4014e814074.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5172

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 acfe689a034ab6cc30c2a1a17fadb47c27c85ce2965ca8689c11594d763034a9
MD5 e58eb7e25e018ebe1311c56d84b85e41
SHA1 0bf38db7b8f9165067d7dc66732531041344078d
SHA512 66e9a1eacec288781921fe7e915566e4119c1395ce04a784c50e4b56c28cf5484835ca2a36f315193d1e2c3d7ee45a818753960b0a47d0302142ccb2ffdf7e98
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzg:gV2/4x0NK6Sl+he8//gTT/dBEzg
TLSH
T185943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe.swap.tmp

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe.swap.tmp
Size 438KB
SHA256 f2e9acc1f02b9908f9d922ca9b59bc1704a8dc859d3e1f305dac383512728b9c
MD5 d96d1d825e470eab5906da6693d668b7
SHA1 d06c53ace00c563c22355d249b902b6adae125a5
SHA512 6fc88cc43184592141450b1be42ea8bfe53c5341c9c28fa35f49866c6d0695862259d28eb2965c5d1d4c67da6d57b1a52dc2df23a38191692c12b67d95028991
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzz:gV2/4x0NK6Sl+he8//gTT/dBEzz
TLSH
T162943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 65a237fe1c307aed4e355e04514cb04c91f65787e998d631c5296fc52c02cb74
MD5 e4a49a455da64a1309c8bacafbcbe900
SHA1 70434d859f9471e9bc4c1cddb3db630575fcd40c
SHA512 c3343143dba90bed3fa7ee6a5067f1b8623c500eb86582becd654b7552ee40484f7cb9031d56ffbcf32543be8bb61ca6f30113fab6eb309cfc0d7732fb99aec7
TLSH
T1BD014748D38B9A6B3105545201D9E31E94ACACB87B043F14BED061C9D76800ED7E1A77
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 befdd340dba8b1657d577b5d211cd364224a1d366c928262d925ac60b90a3a52
MD5 4210aff138e05c12cc54668245d3350f
SHA1 4811f6804e051ac3d71c74732b4ca0b593e4befb
SHA512 7f974acec16652ac292e3f6faa609d1d15512fc954d68b04c26172bf7fcbd50d0f110223c60a3f6b0003a485e985ddd65bf01e58e02162bdfecbc145614e8fcf
TLSH
T1CF016D4CE38B9A2B3105505201D9E31E94ECACB8BB043F14BED061C9C77400DDBE1A77
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 135B
SHA256 a36e0eff6b74e467574160a91a8ab7a68aee4a63bef3c31cd6592f8706bcb74f
MD5 c649461e62632148dda082a4505ce8dc
SHA1 da37112c6741b7074eebf14a14897a5c8f14c707
SHA512 7ed87fb4ef1229be651d1970c1e1eb777a9913470f696131f20339586307a2c409ad54e20dc98434fbe88b948822fc5e99900255baaae1b9cf5002e98bd7960f
TLSH
T141C09B486105545E21DA5044144D77265DDCED94C7051D18FDC49465B76410599E4563
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1920-19-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3476-22-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4484-1-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5172-23-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5740-9-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads