d77b009fbea32aa41c165b4f354e818fbee4e9cc7d408f2716d86071df47decb

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d77b009fbea32aa41c165b4f354e818fbee4e9cc7d408f2716d86071df47decb.exe
Size 438KB
Sample261017-evspksht5j
SHA256 d77b009fbea32aa41c165b4f354e818fbee4e9cc7d408f2716d86071df47decb
MD5 92b90098e9116ab02a2d1692316c9ce8
SHA1 16ffbb549e3fb98b3c8486f89e1ad6365e2a6ff2
SHA512 e9f6a428d274629f62a407f21e0bff9a12c76954059e20a2e05cc0306dcf86260c638df885cc54a0cb18d2b5c8d3dc19a9b6abcec9ebad162f77e8a2c210a0b1
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzg:gV2/4x0NK6Sl+he8//gTT/dBEzg
TLSH
T1D5943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3592	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
4104	EsetNupForward.exe
3592	EsetNupForward.exe
1308	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d77b009fbea32aa41c165b4f354e818fbee4e9cc7d408f2716d86071df47decb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
4896	d77b009fbea32aa41c165b4f354e818fbee4e9cc7d408f2716d86071df47decb.exe
5732	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4104	EsetNupForward.exe
4104	EsetNupForward.exe
4104	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4104	EsetNupForward.exe
4104	EsetNupForward.exe
4104	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 5732	4896	d77b009fbea32aa41c165b4f354e818fbee4e9cc7d408f2716d86071df47decb.exe	89
PID 5732 wrote to memory of 4104	5732	EsetNupForward.exe	90
PID 3592 wrote to memory of 1308	3592	EsetNupForward.exe	93

C:\Users\Admin\AppData\Local\Temp\d77b009fbea32aa41c165b4f354e818fbee4e9cc7d408f2716d86071df47decb.exe
"C:\Users\Admin\AppData\Local\Temp\d77b009fbea32aa41c165b4f354e818fbee4e9cc7d408f2716d86071df47decb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4104

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 0a68e95ca53cddf7e311824943691dea5a579b7a515b8b68728db75769817eee
MD5 560102a0f305b3aacfa139b4112a0b88
SHA1 5edddd4826fb1ccf00ae324d7c585a620655d63d
SHA512 c02f8bbf9b17f474da81bce1dacdf5fca814108fe9d65d661cbd01f78521dae91451666422d00bec310636ac5c142e71af2b6b92b5aaa54f6a4029c19316a5a2
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzE:gV2/4x0NK6Sl+he8//gTT/dBEzE
TLSH
T1B3943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 94bf92edb136559e5c4c486be4dc6aba7d59298949a114550b78066362b76236
MD5 710e91be6fd7755f40e91e02e698042a
SHA1 a4555c49421c718bc5694610eeb3e889ef1d12c3
SHA512 43e0ba231e1c792f7b9358e04a95cec145bfde2c5f7415667fbcd4b05c66967222708cf54fc574fc5cf0106524b160bb0b4b054c8644106d5e7e957aa612383f
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzC:gV2/4x0NK6Sl+he8//gTT/dBEzC
TLSH
T147943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 135B
SHA256 95de127c1b8563245b9cfc2478601454423aecacbb3e7ed36100c9ef122c22fc
MD5 11cdf0e22d2c620e10e6b832b9dfc7c0
SHA1 31f2149cb7fa6bd4c7c295a207cd1fe05472289f
SHA512 8a275cdc9258263287dce1af6bc683153fa6ad27d8d9763fd226396320ade55a3d836ab0032c46ec059c2e9da73067a6b20a90dc3b95361b6e4b28b612ac5865
TLSH
T146C09B4864077C5E12D65094148C556557ECE594C7061D185FC5886DD6D413689E09AB
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 82d32701b260df4bfbcf55ee3381fbd93cb4b0e03e23253120167bdba639ae98
MD5 97e1be384e49b9e11190e38b9e55f4d3
SHA1 a25258d1415b9c77f3c32906b6b13619f887d7da
SHA512 7adaa250777823f925ce975cb4edc7b901fc317f31b67f1d24c4d2cffa2c2331210230d447aa4ba7cd031700d135e3765f29a1113fa0532b046b430e156906d0
TLSH
T122014C08D54B9E7B030151A3019CE29D91FDA8987B4937209F90494DC7C803FD6E1E7D
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 5cace311a442b94fd01988c58c0a961feeb0b9f3b52ce8af7228a558bd86890c
MD5 059b3da6aa00b7e90de8c5299dc4fb75
SHA1 822934ca2b54cd406590df7efb3b47ee1eb81a64
SHA512 e8313c7e8a73620e0bb31e53f9adf919a53cde46d34ff0c13f934ee91dada289393dd4f7efb52b522a661f96b015b560f0e422cf59cc06276af892890402faa7
TLSH
T1BF014908E54BAE2B03025192019CE2A992FCA898BB493B149F90494DC7C803FDAD1E7E
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 69B
SHA256 4f13ecf0ee40eaaa1b1bcac7cb82cd6e97c4f31bcdca93add0c541ca5f5c17da
MD5 81764891fdf3b74423b650f74cdacd72
SHA1 335615cf4361c47fe195c50bb082445e67360fac
SHA512 a0fe1568938c664a27f2b0158450e383a8522042e9fc9349b73a851f82d6ecf9f1c93728271ab8d199967e51f4b13881ee5b58aa9706f2244823ae72df9c65dc
TLSH
T15CA002593806340913A600942859987157FCED59DB564D4D2E819C7DC7A832A5EC449F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1308-27-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3592-25-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4104-28-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4896-2-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5732-12-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads