7ae8c461929a558c1e5c056cce9f21b9b9282305b55d2b3678868e4bfc55880b

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ae8c461929a558c1e5c056cce9f21b9b9282305b55d2b3678868e4bfc55880b.exe
Size 438KB
Sample260930-jh7eesv13m
SHA256 7ae8c461929a558c1e5c056cce9f21b9b9282305b55d2b3678868e4bfc55880b
MD5 ae16711b4ae2399aaaa716ca094f54ca
SHA1 228eddaa5b26b61aa87bf9276d4f1ab8c4e35115
SHA512 bbbdc0c05dd5e8145c2dcb1ddc16f8a017bb9c229c7e79b522e14485621c0ec9915d2db4ee47c2aaae9fcb28982b6ea0b6345deb39e8039845f360977c368139
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzE:gV2/4x0NK6Sl+he8//gTT/dBEzE
TLSH
T1FF943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3224	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
6140	EsetNupForward.exe
3224	EsetNupForward.exe
3176	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ae8c461929a558c1e5c056cce9f21b9b9282305b55d2b3678868e4bfc55880b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
5688	7ae8c461929a558c1e5c056cce9f21b9b9282305b55d2b3678868e4bfc55880b.exe
3068	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6140	EsetNupForward.exe
6140	EsetNupForward.exe
6140	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6140	EsetNupForward.exe
6140	EsetNupForward.exe
6140	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 3068	5688	7ae8c461929a558c1e5c056cce9f21b9b9282305b55d2b3678868e4bfc55880b.exe	89
PID 3068 wrote to memory of 6140	3068	EsetNupForward.exe	90
PID 3224 wrote to memory of 3176	3224	EsetNupForward.exe	93

C:\Users\Admin\AppData\Local\Temp\7ae8c461929a558c1e5c056cce9f21b9b9282305b55d2b3678868e4bfc55880b.exe
"C:\Users\Admin\AppData\Local\Temp\7ae8c461929a558c1e5c056cce9f21b9b9282305b55d2b3678868e4bfc55880b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:6140

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 02c299b57fcfc3359a7dfc72b3d60a51534213824cf6038c2439a1fff51afb54
MD5 45c4b4af78e387d7c0c4b1a744786f2a
SHA1 d208c963a5bca6ae37fca33ab81ec6a09ba1f980
SHA512 855b6ba4c6960d8b19807e38a34d250ec95882c578e5203622b7aae79ccb0ca6307ecf85b79af62d2fdc41119ce46823f5310116596c82adfacb76e478a56971
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzw:gV2/4x0NK6Sl+he8//gTT/dBEzw
TLSH
T1DC943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe.swap.tmp

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe.swap.tmp
Size 438KB
SHA256 f80a8c61c670b38b6fdfb91406f3e1e2d28be495e5d478c4460596e57e72037b
MD5 b184f0a655916e5ec7e91f14a8cf0baa
SHA1 4d146a43131bc34974dad89bff0244a8049564e9
SHA512 16de0ec536f5da91a6c0a611f3f5743666e049924555faacb7931efc4134d50fac128e062a2d2963391bb41dafec72fe937a3f8f1494e95a6fcab40efae36ad8
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEz4:gV2/4x0NK6Sl+he8//gTT/dBEz4
TLSH
T184943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 256949da95844157622f78d16c3f90443339705e4818290b1897dc267b68141b
MD5 7a82429a85ef42da3e945951d1bdb5d3
SHA1 bf5b22627d61c79ce0b5b1361d7d000e682a3aef
SHA512 0c7d5768047313c8cc498f855b62c10a649e373fa6f76318a57c9c4a34075c502b141ffb97776bd17b35fc8e633edd702280da2bfef23a2af54c94d14d38c568
TLSH
T112014C0CD38B9E6B010AD4363155F91FDCADB89D7B043B159EA089458B8400EDDB16A5
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 2f29c27fc7cbe92bf26a28a73f8946f10787ff86275e0a5244b3fe49ff95c5a7
MD5 345697de45c9bf7af4479a1cb5d1deae
SHA1 7affb1babf397e4ab2524dce21cd34f3512e5612
SHA512 583613dea894aaeaa3019c8c4d58403550dc56ccf40c7a39214ab58718d45ca3689e42a7031758da1de6fc1cd95671679bc1e5a7a9dcd6e6ef055f6b1cc253be
TLSH
T1B801490CA34B9E6B011AD4363059F92FDCEDFC9DBB043B159EA089498B8400EDDF16A6
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 135B
SHA256 fda43518cd535dec4c63d71770f76d11284d96f877969003bccb2fd5c0f4f8d2
MD5 acdec240f3785d16b19251b57d7a3cac
SHA1 580cecf219e9e76b4448c1ce0bda3723b1269554
SHA512 bdb8753fffea2e02ab0e24e3b95dfa5fa41c0f1d3aa3a122836b9aab1b33b85ab0ec4526519793b4d0261a95358a1650a06bdf9d1b7d16c5ae2152b6d5df66b6
TLSH
T1BDC09B4C6109546F11DE5158344C7D275DECE59CC7051F185DD48C6557901058CF0567
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3068-9-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3176-22-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3224-20-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5688-1-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/6140-23-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads