eaab0a7d0ac1d892b1c9b154972d5c0a87c6faa14277121d9cd80888a6e046a3

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eaab0a7d0ac1d892b1c9b154972d5c0a87c6faa14277121d9cd80888a6e046a3.exe
Size 438KB
Sample261022-x8lsasxt2l
SHA256 eaab0a7d0ac1d892b1c9b154972d5c0a87c6faa14277121d9cd80888a6e046a3
MD5 9a65b70989236da081b27238b36cac96
SHA1 69e4ddef77c0024df053394d51e4dc78a49f7a0d
SHA512 6597ad0635fc33bb52a9867f226ec429f6d5ea3be3aa6cccf192412b7916e1f82d15f67f97dbc324d170c18aa42e4d009adef398be6638538fcb82ace338344f
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzo:gV2/4x0NK6Sl+he8//gTT/dBEzo
TLSH
T10B943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3164	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
4592	EsetNupForward.exe
3164	EsetNupForward.exe
4796	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eaab0a7d0ac1d892b1c9b154972d5c0a87c6faa14277121d9cd80888a6e046a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
3112	eaab0a7d0ac1d892b1c9b154972d5c0a87c6faa14277121d9cd80888a6e046a3.exe
708	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4592	EsetNupForward.exe
4592	EsetNupForward.exe
4592	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4592	EsetNupForward.exe
4592	EsetNupForward.exe
4592	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 708	3112	eaab0a7d0ac1d892b1c9b154972d5c0a87c6faa14277121d9cd80888a6e046a3.exe	89
PID 708 wrote to memory of 4592	708	EsetNupForward.exe	90
PID 3164 wrote to memory of 4796	3164	EsetNupForward.exe	93

C:\Users\Admin\AppData\Local\Temp\eaab0a7d0ac1d892b1c9b154972d5c0a87c6faa14277121d9cd80888a6e046a3.exe
"C:\Users\Admin\AppData\Local\Temp\eaab0a7d0ac1d892b1c9b154972d5c0a87c6faa14277121d9cd80888a6e046a3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4592

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 08d99c8f591ed465c072f21492f9d85ac5ff875d8b606b0df822ccb1b1a51055
MD5 d779c40551e53a7320c0e5d290af4936
SHA1 6955c99617e2dac9f90a161d920e8936f6eb55f2
SHA512 9a9afdc9cd4d4d0567a84d295edf9795e86cbd3d8c8b3758979db46c0cbff9a2d29f8452f525b5886bd187078578844ee85c2aa036b955d634512069eb072096
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzv:gV2/4x0NK6Sl+he8//gTT/dBEzv
TLSH
T18F943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 e4566aad2b7dc8551cb2a1a138332907bee2a561a2aace129e0afa94a3f72e2a
MD5 154cf0a34fb22499fda71eb7251c0031
SHA1 4465cc31321c645f860f1280fc068ae3ece67071
SHA512 b8f10cb90eaea9fd754049dd795349f5cf55c9ae91e0797831e13c973bda69b588c9bae140e1e8b94a713eb1fcfb93e61b1eaa3b9f25fff56f4f96de0a9ad4c6
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzh:gV2/4x0NK6Sl+he8//gTT/dBEzh
TLSH
T156943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 69B
SHA256 f7f28afa1e45172ed22c9e181c6ac9f3a18b100f2cf441d14db41b8f68ef2b04
MD5 265178607cd7dea4c6f4c08db44aa0d6
SHA1 12139168ec557d8487059adf0c2797e3c25191f5
SHA512 7483778918bf0ba40c370b6a02ab96cdf3dbc2ee3c545b65fa9d088340d0e3f6f03b3dd8f3363daa14dc6562049a3fc2a83c7358ca3631561d67d21643a5860c
TLSH
T177A002593409700D223605443C19883156E9EDAEDB598D8D2A81A86D87656095DC4477
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 a2197a6b7cbf4cebcaf1a81e90b55f336d1cc849c245987fd5020d5e10080870
MD5 95795a29ffc82cf223e0761dcc1056d3
SHA1 8aeccb541a3f7d50b717d80331cd05dc55c68be4
SHA512 117f9f5dbb18a7ddbab1d83f806dc7cad3c69f2475f889213c51d5851c88812cb6c9a1e3e3b2466dc7c8f31d3080abf83a8ac117e42f5c89b87cc52498980c5a
TLSH
T1EA01F748A18FCE3F01066F62119AD15D94AAA8EF7F04FB94DE9081998746409D9E1772
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 ae36d101f2b42acbfbbe23cab0d8d1680b84c249e3ba401a5dfaf3c207fabf9f
MD5 341313d1b721f65d4e8871c2fc338e7f
SHA1 e08c1ee692eaa1b7e4daf30493021d95e1744a09
SHA512 2c77aeb66bed122867bce3a8233b4962ac834b9fc658d9774df115f588b7467d90ff7f50bc8ec95e78afaecacfd90d85cc3c5137800f8aa1952031ba4c81c132
TLSH
T1A4016808A18FDA3F01066F62115AD05894FAA8EFBF04FBD8DE908198C74A00DD9E1772
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/708-11-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3112-2-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3164-25-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4592-28-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4796-27-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads