668f3fbbdf7ef8387c7e0dc9842fbfd608eb822a285e46e649e04ccc5b43e181

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
668f3fbbdf7ef8387c7e0dc9842fbfd608eb822a285e46e649e04ccc5b43e181.exe
Size 438KB
Sample261014-3kl12scw7y
SHA256 668f3fbbdf7ef8387c7e0dc9842fbfd608eb822a285e46e649e04ccc5b43e181
MD5 eddbd820d7df187783e5d33d28c02081
SHA1 b9446ef4df4922e46abbd732a2ccf0271bfc9d78
SHA512 7962ef10e5125940167495045b7d914784ded4a6b40c6b1308920f1d8071e93538ce3e75cf481734e60695e870a1edb2e996c35ee24b7bb4d807a60c899df5bc
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzP:gV2/4x0NK6Sl+he8//gTT/dBEzP
TLSH
T178943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1604	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
3852	EsetNupForward.exe
1604	EsetNupForward.exe
4560	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	668f3fbbdf7ef8387c7e0dc9842fbfd608eb822a285e46e649e04ccc5b43e181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
4284	668f3fbbdf7ef8387c7e0dc9842fbfd608eb822a285e46e649e04ccc5b43e181.exe
5200	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3852	EsetNupForward.exe
3852	EsetNupForward.exe
3852	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3852	EsetNupForward.exe
3852	EsetNupForward.exe
3852	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 5200	4284	668f3fbbdf7ef8387c7e0dc9842fbfd608eb822a285e46e649e04ccc5b43e181.exe	89
PID 5200 wrote to memory of 3852	5200	EsetNupForward.exe	90
PID 1604 wrote to memory of 4560	1604	EsetNupForward.exe	93

C:\Users\Admin\AppData\Local\Temp\668f3fbbdf7ef8387c7e0dc9842fbfd608eb822a285e46e649e04ccc5b43e181.exe
"C:\Users\Admin\AppData\Local\Temp\668f3fbbdf7ef8387c7e0dc9842fbfd608eb822a285e46e649e04ccc5b43e181.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3852

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 2f775dcdbf9f676b38facda6df9ad2b59e5cb2c39a7eed414ce9f104ae04c366
MD5 dab78ca86d6dc79e4adade12fcdd5b28
SHA1 4125e3f3ceacd65074237543d2ea4eb393de5b91
SHA512 0eb6314702ba6d82d6cd1b3ebb6f1097ba026b35d489c5044534583fb235966660f133649bb3df42457f30e4cd321a4381327f83a11b3905df89a4f9b27d7107
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzs:gV2/4x0NK6Sl+he8//gTT/dBEzs
TLSH
T13C943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 ba8518c07bcbfaa5c7f3c7d4631da2e46434a09438fd309d53880c0591a12776
MD5 ad77f3e7088576fcfddf94084f108a98
SHA1 840ccfe3432a5bda81bee3d6422787dcdaaeb3b0
SHA512 141f7385d0aa09ca775c13233a432ccc7b5c5e5cfd7f558826b428b1445be1a0ec2f3c0655d8513ff2f72e52d586af33c5250197ed4875ad2401ad3383737079
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzV:gV2/4x0NK6Sl+he8//gTT/dBEzV
TLSH
T135943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 69B
SHA256 c6c6cd5312bac7134d78c90c44991a2eea0c5ea52f3a331a3cf11e15ae7de141
MD5 ceca0443c11d97034a068c8ccb51fa66
SHA1 e1b54050d475266b538b6d4164b753bf2b0687ac
SHA512 e019773fd88261f1dfde67f4964b993e467fc069537c95e7f61465d90fbbee57bf18f6ecf603cb932acadd4a178af4feb0564be6ee291d79ec4678a6d011356f
TLSH
T197A0228A3000300C02B200002C28C83002ECEE2ACB008C0C2C808C3CC32220A0CC00E3
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 aff7945be145b0a09711a9fa73d974c7bf034335ae132b76a44b30eed3a10b11
MD5 7bc6d287b1ad9b7ec8666ecf8dc305a4
SHA1 8f14456c3084de344dab3668e6dcec875cdb3891
SHA512 2363252a4e6b291ff0792f024690c527128a622fff5f6b2afa21cd887b421ea2e471890af62dc9cf892b0cd96508cce65f6b4d8e55f89f9b8ad9af9fe75bb993
TLSH
T1FC014789D19BDE2F01029C630998E15C90ADAAABBF057B149F908948864640FC5D27E2
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 819B
SHA256 3fe026ac4b1743bdba3efc2e38b1e58bfa573920a3f231b61834a1bb503f50d4
MD5 1bcb2aa0d2612815171139b7f85babb1
SHA1 ef0ac9ade308c0ab15262b752ab52687a11609a0
SHA512 afe6d3fe7ca7fc1c2421ad7f2d55f6971e26ef4b483929d6c0f54123e665459e4e7cffbc2bf9bc4132dfba3d627bcc9e16317adb163d4d98fd739281d0476a8a
TLSH
T177018989E15ADE2F01029C520D59D16C90ECBEABFF05BB149FD08948864700FD8D27F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1604-25-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3852-28-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4284-3-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4560-27-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5200-11-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads