fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173

Analysis

max time kernel
149s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe
Size 438KB
Sample261027-yahtesfv6z
SHA256 fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173
MD5 c7e0064a35024226df4927f92a6d7a07
SHA1 aa9a3639e78666b286984a7910bb1010b2760dd7
SHA512 fa7ab9486a2d7658173e9dadacc04eccef41bb06b21f87a47f69114296927f289739cd908da4e815f978e7a4691a32a4cf0d0c75ad70d9f5b18760dca014c4bb
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEza:gV2/4x0NK6Sl+he8//gTT/dBEza
TLSH
T1DD943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4812	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
3308	EsetNupForward.exe
4812	EsetNupForward.exe
4212	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
2660	fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe
5060	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3308	EsetNupForward.exe
3308	EsetNupForward.exe
3308	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3308	EsetNupForward.exe
3308	EsetNupForward.exe
3308	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 5060	2660	fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe	83
PID 5060 wrote to memory of 3308	5060	EsetNupForward.exe	84
PID 4812 wrote to memory of 4212	4812	EsetNupForward.exe	88

C:\Users\Admin\AppData\Local\Temp\fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe
"C:\Users\Admin\AppData\Local\Temp\fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3308

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 fbaf5d67900fbcc44034c4a7d620365ec2745ec7fb534b8a104d9e6d2a88db92
MD5 ec9099d8196b41602bd426feeafc2206
SHA1 ad95481e6dafb010ccfa1b3c74ebfbdfb3a18354
SHA512 88362f197f58e3d710b630799e0c0401d48fb81cf9f4c781907ffe25a7466e1c70ebfb801bb4a25d0348f8751633eb2cffe65c64c9797353fd1b0641f344c49b
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzH:gV2/4x0NK6Sl+he8//gTT/dBEzH
TLSH
T1B1943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe.swap.tmp

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe.swap.tmp
Size 438KB
SHA256 750312fc66a0a9c319d4a0e82190cffe8bc270bd5836f296bedc5216bdf640ca
MD5 300e0f890bdd0ebbe5fb61e797561f2a
SHA1 9086b33aeff03e87b915f24a8bb9f6ba706a2b7b
SHA512 c7b2aff55989a71e0695f4d64b0bd437a5ba84f15734dbb2dc62bfe2e44ccfa131908b9f8855fcbb5bb0469b4a520dde2d2d69e295bc8972bf336408b12a79af
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzH:gV2/4x0NK6Sl+he8//gTT/dBEzH
TLSH
T1F9943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 a9d03799eb881bdfb7734e778a122a5e53f9630332756f2c409fc8f727e88420
MD5 b5935e8f64e7d45fd4f2087fed8e67de
SHA1 201e82389a25b610504dc145931a986180d51d00
SHA512 c5324b62d18a6d70a23dd04d8113ebc42105e04b5816a6baa12e3c9264c19eda6bbfd783cfbf0c8877d21afba20ed55a0f7d9f17cb32fd206253a9ccf7940738
TLSH
T13901F70DE28FCA2B0105647309BAE15D94ADB8AD7F4CBB289EB061CB874440DF5A1B62
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 7352940c3922ac190296d6d58c282aa4bd7c7b653027d5fa6c94175ac126ef08
MD5 34db03bc1cf76b542f6450904532a962
SHA1 02da0f8bed1e4374de9dc7152bc97b4499c3c232
SHA512 e8e4b484faac61899ab9f3e7ff8b1a601f3616dab3589922f976f1b1cc912ebb106abbed646e394cd7b8e1a6e83ae50263d395207085d0d16ca94db0a5598284
TLSH
T10A01F90DE14FDA2B0105647209BAD16D94EDB8ADBF4CBF1C9EB061DB874400DF9D1762
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 69B
SHA256 1e97f95210b8bc31aff25e59e1688b066ce406146bfa19f7654e1e37a4e96386
MD5 91d13ecc95a83cdd9c75cf1c102457b8
SHA1 bad4145c4d419194fdee2b6aabefb87a05481221
SHA512 9ec6fa5352c0d198aad0375c9a8cf9ddb5a90d97e849ab7f0ee1c3dec0834605b925ea7e42404e6053a2295fc9e1f9d4eb005b409bd9d6d90c660b16cc172346
TLSH
T1A4A0025D34097009122600542C2A887256E8ED5DDF598D4D2995B8AF87647096DC4967
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2660-2-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3308-28-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4212-27-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4812-25-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5060-12-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads