f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe
Size 438KB
Sample261017-bda7esft7j
SHA256 f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b
MD5 d9cf36045c747822e66988af4142e197
SHA1 e65748c3a5a595c0dd4a7e975a80b319a426713b
SHA512 32467b01f2d08ddcd95a9c7c41cad2923589e6d55e22289309a353580b9dbf0a15593e5c2d1ca69e0c735fbd5aca2eb2c35a8a5960d2f27d24ed38b1eef69385
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzH:gV2/4x0NK6Sl+he8//gTT/dBEzH
TLSH
T1BA943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
312	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
312	EsetNupForward.exe
3272	EsetNupForward.exe
536	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
740	f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe
2216	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
312	EsetNupForward.exe
312	EsetNupForward.exe
312	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
312	EsetNupForward.exe
312	EsetNupForward.exe
312	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 2216	740	f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe	86
PID 2216 wrote to memory of 312	2216	EsetNupForward.exe	87
PID 3272 wrote to memory of 536	3272	EsetNupForward.exe	93

C:\Users\Admin\AppData\Local\Temp\f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe
"C:\Users\Admin\AppData\Local\Temp\f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:312

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 070f4eb9960e825487b6b8b75d59ce8e7572c57ce5b45b2d9c88f96a7c0cd984
MD5 744f03af6ad415a1dc8690b96a135c80
SHA1 feac8a56aa340b58c81b3ef97a25d7c1ce6d3ff4
SHA512 ca3909752ffffeb8720a22521fedd547771e3bc6814342a36908419460c59cebb5beb48f33436e4c4929be7b846605ff03c21f424c5d299e40be58364db882bd
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzc:gV2/4x0NK6Sl+he8//gTT/dBEzc
TLSH
T1F4943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 bcbd6d760f5919ae5e2b5c8152c6cc6277d8256eafadb682441c883f5c815125
MD5 38bf6dfcc8d85ec012ce767fe71d6042
SHA1 41008c2f095482104de3d0ca8c6ec665578195ab
SHA512 d751517d9b30edd07d2d882585de82b2620f27ecad3c5deffab06c4d258994c029d44f16b621accec962c1728b5f8804161f2cd1c3c326bc026d490e5d9d3bff
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEz6:gV2/4x0NK6Sl+he8//gTT/dBEz6
TLSH
T1E5943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe.swap

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe.swap
Size 438KB
SHA256 f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b
MD5 d9cf36045c747822e66988af4142e197
SHA1 e65748c3a5a595c0dd4a7e975a80b319a426713b
SHA512 32467b01f2d08ddcd95a9c7c41cad2923589e6d55e22289309a353580b9dbf0a15593e5c2d1ca69e0c735fbd5aca2eb2c35a8a5960d2f27d24ed38b1eef69385
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzH:gV2/4x0NK6Sl+he8//gTT/dBEzH
TLSH
T1BA943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 135B
SHA256 5a660d90fea0c045fca16bd0d19fe47bb9a5a94a99993207ccaca9926512d9dd
MD5 c2fd5094de10550f6e24e7a510743805
SHA1 9ca63bf7c7509c30696b3d9ba4c6e87559d2370c
SHA512 d9c74c5fbfd2292be823da52da006079583476bd4e19d5cedd6375fed9cdfef5cb19ce2fc48a44f49db9f9bc6ac63afd685615d79ec3bed6aaf83326f9646320
TLSH
T1D7C09B59A007545E12DF7048248C7F27DDDCEEADC7051D185DD8C5655EA010598F0563
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 1e613502793b140a78f52c679bd52f29420a0a91572b1560b6d1c4bdd258af02
MD5 3fd1c0d55fd1cc9f7fa15bdf5bfb2230
SHA1 89e99b6fea163035208287308bf27d44a070522c
SHA512 f7d8deed14bbc56c99ab79126b802195836619eec998b9250a7c0dccf052d4d542c0dcc07a5f427f21ef6363393735d90ff708d96aa31a82934fe1a56f8c8813
TLSH
T1BC016899D18B9A6F020E741701C4FA1FD8ACAAAF7B043B108E98C2488E4440DC4B1666
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 c4e7eae1ed1a041726d0423c731f34ca341bb3302d0b56782b4ce87253085f52
MD5 79cb394181ed1763821d94f3af1e3d4d
SHA1 ba8f5dcf51dc128069e74a07f4bf31f587bf534f
SHA512 2169357327e1a066ee879dd7bab45eb74031c14e86c97f1c00a363c9f97e156013faeb3fc49381b35efaf4481820acf173e2ca3147bc4a87035685ffb4c0059e
TLSH
T116014E59E14B9A6F030E741715D4FA1FD8ECAE9F7F043B149E94C2488E5440DD4F1676
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/312-28-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/536-27-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/740-2-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/2216-10-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3272-25-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads