3545a06a41c679c3db2d67642e4ba38e4513ee5f4242c0623a932b70e915dedf

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3545a06a41c679c3db2d67642e4ba38e4513ee5f4242c0623a932b70e915dedf.exe
Size 438KB
Sample261017-dgrppa1w5m
SHA256 3545a06a41c679c3db2d67642e4ba38e4513ee5f4242c0623a932b70e915dedf
MD5 ca57006f83fa45dbb9e8fb4bfc159db9
SHA1 5d33669a1dac30ea45e0844e6c266792e95cd279
SHA512 d53798d44b3faba37a1ce7e1a5e5038fb40d76a1b1f19460697f7d0f2e7048326b2442a7c1ba248d113421fd796b8e25337033548c4adc0983cc8fc03818a3e4
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEz1:gV2/4x0NK6Sl+he8//gTT/dBEz1
TLSH
T1E1943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5496	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
5032	EsetNupForward.exe
5496	EsetNupForward.exe
2908	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3545a06a41c679c3db2d67642e4ba38e4513ee5f4242c0623a932b70e915dedf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
4748	3545a06a41c679c3db2d67642e4ba38e4513ee5f4242c0623a932b70e915dedf.exe
4532	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5032	EsetNupForward.exe
5032	EsetNupForward.exe
5032	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5032	EsetNupForward.exe
5032	EsetNupForward.exe
5032	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4532	4748	3545a06a41c679c3db2d67642e4ba38e4513ee5f4242c0623a932b70e915dedf.exe	89
PID 4532 wrote to memory of 5032	4532	EsetNupForward.exe	90
PID 5496 wrote to memory of 2908	5496	EsetNupForward.exe	93

C:\Users\Admin\AppData\Local\Temp\3545a06a41c679c3db2d67642e4ba38e4513ee5f4242c0623a932b70e915dedf.exe
"C:\Users\Admin\AppData\Local\Temp\3545a06a41c679c3db2d67642e4ba38e4513ee5f4242c0623a932b70e915dedf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5032

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 d18b3a0e21d36691bc760cd4574183d0043980e5e0faa9f152da21538f1610e1
MD5 40ea8578d824fa6d60dd1ce4bf07a211
SHA1 b1174189ef7c00112706c62d7074df2286a2288a
SHA512 80984c7fe0614f93c58f1cac4c7fcb139c53b18af3628310a646c1ea236aa0d66959b7a3c71d0f9b69f8b897d223d58f0b3a6c5fa434a74336b5eadc910372fe
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzp:gV2/4x0NK6Sl+he8//gTT/dBEzp
TLSH
T137943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 d193d44825163884fa39e624f822502241077e2eccb4c75c40b3a15382cd8fcd
MD5 51b056a4f7e0348bb2dba0036323ffa6
SHA1 c8aa54dc8a4f4f17b46c9171041677164ace7f0b
SHA512 52ac003bb8b8e3ef041b3b094ec9951d77a03e1f5b839ce37e1b6c03d7fd744c11714323c048502ba3db1a9dc23201bfffa730d6752d51b283e40895fb0ff6b2
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzB:gV2/4x0NK6Sl+he8//gTT/dBEzB
TLSH
T1D8943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 69B
SHA256 c257c78964c906de3b05e4575cbe16b443d6adacbd35186ae8f493ce63e92c37
MD5 9b1c0a6f2db8fa19e59da51152e60dbe
SHA1 2a4f580ef8267765e7888792691c3b2d0ec4f206
SHA512 0ec772fcbe2e552b25aacc1d52abe7d8f83b91cdcd12913ddf237a01a9faa213e031e9f55bdd0ad1a67c5a3bfe85174ae4890d97794fde488fb6b9eaa7b1485f
TLSH
T1D6A0220A3002300823A20000280888300AECFC28CB000C0E2E8088FCC3202080CC0003
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 898115067f6bde53dbcfc3dc9cac45d1591ee25a79c8f4afb221b6cc57999bdc
MD5 39c200c887d5ad24e6a2ac2b25a20989
SHA1 77538b0a5753e5c69bc78f7d19ff6f127c673262
SHA512 a1cdaf0b4dc634c33ef64f6a6c7134eabb58ee6fc8e720a5dd85590d1a4e06bcecd86ed0e776e79cf40959435804c66e36eddc0ce55167a0b04e7c67acf026bd
TLSH
T197014C0EF28B9EAB2105A61281D4F35E90AC7CA97B047B10FED0818C864700DD493762
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 10994b3a2bca5ec015c924afcdad1f46b3d3def34d878dca380141cbc912d355
MD5 f2a205887169a84c83f8a8a19732fa2c
SHA1 497ab5a8df9bff1d94a5a43f2a09494044a376be
SHA512 ed5e0f83956dd68c5143a1f38fb70917dd0176f057a4b968837f3266663abf3c7cb00bddf72c6032d63c9b8861a69e22ec6ef225645126a7872329b3d7e6d4e4
TLSH
T11E016D0FF28BAAAB2115661681D4F36E90ECBCA9BB047B14FEC0818CC64700DD8D3772
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/2908-27-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4532-12-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4748-2-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5032-28-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5496-25-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads