f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe
Size 438KB
Sample261017-bda7esft7j
SHA256 f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b
MD5 d9cf36045c747822e66988af4142e197
SHA1 e65748c3a5a595c0dd4a7e975a80b319a426713b
SHA512 32467b01f2d08ddcd95a9c7c41cad2923589e6d55e22289309a353580b9dbf0a15593e5c2d1ca69e0c735fbd5aca2eb2c35a8a5960d2f27d24ed38b1eef69385
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzH:gV2/4x0NK6Sl+he8//gTT/dBEzH
TLSH
T1BA943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4248	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
4248	EsetNupForward.exe
3424	EsetNupForward.exe
6112	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
5648	f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe
3400	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4248	EsetNupForward.exe
4248	EsetNupForward.exe
4248	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4248	EsetNupForward.exe
4248	EsetNupForward.exe
4248	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 3400	5648	f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe	89
PID 3400 wrote to memory of 4248	3400	EsetNupForward.exe	90
PID 3424 wrote to memory of 6112	3424	EsetNupForward.exe	93

C:\Users\Admin\AppData\Local\Temp\f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe
"C:\Users\Admin\AppData\Local\Temp\f125256b37c38470ce2d1182ea201b99d4f9773b3ebd6927d075d4d3a61d494b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4248

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 52c4728db2515d5d8229900fb6fbd27b457094fab57905430fe1c3e0677c0568
MD5 c4b858f95d6cd34da55227a5cb52841e
SHA1 27a90a6e4b9eca91f7c30796eddf7f2a14f339eb
SHA512 ae8111fb7647fd3bd789b14f49f18a92c69664860067197ded60ef45cd68af125768e9c76288a58a9007955810ae001749fda0de003dfb0886f88f6c165dfaa5
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzY:gV2/4x0NK6Sl+he8//gTT/dBEzY
TLSH
T1BE943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 84763e23c7ea04c96546ea515038398f3eb81661e40d1d5ed8bd6b4b2bd87d58
MD5 f1f72c39a9184e87e71f265c30a7be08
SHA1 b7a3520ac494df332f2054a9564db2d8133a36c8
SHA512 b7431f0fd9bc8c008695809784088a66491ec4282840af70adb326e472631b4a520b65b4f7a5efec98103efe4bdd65bd06ce9357d839c1be301adf8b37171d4d
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEz4:gV2/4x0NK6Sl+he8//gTT/dBEz4
TLSH
T106943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 69B
SHA256 9a65eaba98f7f27c3c091d58c38ac7258d18c7aa52b7654803684d200de12508
MD5 6b0da52f40cc4ed84327c67e7f911715
SHA1 7cce3eb48d095b68b08023c38e35b6800e8532d6
SHA512 26b32b0568f9e1120d4159ad19e87bbfefc60ea49ece0bf14517c9830ef213e272eb95ab05229144905e2888dc9a5db64850c85881fc21b992b0604e37115c17
TLSH
T10BA022A83002300802AA00082888AC330AFCEE0ECB000C0C2CC0C83CCBA03080CC000B
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 46296b1e0fb619a669d25e794abfd46885ae571d0462aeb46597c69b03cc74a4
MD5 ea2cec72bbac56eac40606e182485431
SHA1 f78ae58f93642492eb9d028483819230145eee72
SHA512 a697c4d144e3076dfbde4034ca1cbefd4059c6d0db4f38ffe320a2a92b21f91e983121af008808b3961c85bdb43d44cde9f8c432b77182f7bbfbc38c87b9008d
TLSH
T11001475DD18B9E6B020D756B11D8FB1FD8ACAAAE7F043B249E98C3488E4400DC5F2676
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 e9140df6e1008e44d96d80f1f969ef8d2facde46d0ae8e3138ecb0e8394bef79
MD5 5b0d7ef718ef39f4e4e86920a47896d4
SHA1 5cbb62733563ce02326d187eaa3232330acb021d
SHA512 156e6cc961bbf75d64fad903ecd2044a86bf96aa66a3eab568a0040c7417bc3af24424728b763e83135d8b4c99e499175216abe3510e603c4cd0f3ef84f47fcf
TLSH
T1CA012B59D14B5D6B0209745A11D8FA1BD8ECAA9EBB043B145E98C3588E44009C9F1666
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/3400-11-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3424-26-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4248-28-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5648-2-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/6112-27-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads