fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe
Size 438KB
Sample261027-yahtesfv6z
SHA256 fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173
MD5 c7e0064a35024226df4927f92a6d7a07
SHA1 aa9a3639e78666b286984a7910bb1010b2760dd7
SHA512 fa7ab9486a2d7658173e9dadacc04eccef41bb06b21f87a47f69114296927f289739cd908da4e815f978e7a4691a32a4cf0d0c75ad70d9f5b18760dca014c4bb
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEza:gV2/4x0NK6Sl+he8//gTT/dBEza
TLSH
T1DD943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
876	EsetNupForward.exe

Executes dropped EXE 3 IoCs

pid	Process
3368	EsetNupForward.exe
876	EsetNupForward.exe
3440	EsetNupForward.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\EsetNupForwardC = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\EsetNupForward.exe\""	EsetNupForward.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EsetNupForward.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
4948	fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe
5540	EsetNupForward.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3368	EsetNupForward.exe
3368	EsetNupForward.exe
3368	EsetNupForward.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3368	EsetNupForward.exe
3368	EsetNupForward.exe
3368	EsetNupForward.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 5540	4948	fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe	88
PID 5540 wrote to memory of 3368	5540	EsetNupForward.exe	89
PID 876 wrote to memory of 3440	876	EsetNupForward.exe	92

C:\Users\Admin\AppData\Local\Temp\fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe
"C:\Users\Admin\AppData\Local\Temp\fc2b3c3f356286537f2451c8e5b4f21a5747a45eee3f8e14c899b6a03eb09173.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
    "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3368

C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
"C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
  "C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe" --nup-hash-swapped
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 223fc019bcbb11aaaf36f8ac7511c7c1b2769512ef75710883a8bdc288de6dcc
MD5 7618a7f466e4f90dc193bbc26f72e344
SHA1 3b0241636cd44c707b49f009318db92a1b7a7bf8
SHA512 ce6ea6dfa7d4bd42d613de1ab6f68875b357be341d5909b02b214ad691e712aa65b6f2238ccd14523f4d70d5fd6bb07c53da9ae62fef98468342df8acc05a89b
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzn:gV2/4x0NK6Sl+he8//gTT/dBEzn
TLSH
T16C943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EsetNupForward.exe

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward.exe
Size 438KB
SHA256 500d26f7d40344ad74e76db6871dfb77412c0c2236aa17601ab2595f634cd6ff
MD5 1938c21429bde9779f90c8ee8c14a859
SHA1 7d5cc13c62ae963b7589776cbd42f5aec36fca37
SHA512 2a5ae1e455da9c3325b3b429a772e660d9d83c1b8568d501a67ca948d4daa42cdab023fcdbd41d767353bec6ac16734c8abf49883bf61e5c6e7748a0f8bb83b6
SSDEEP 6144:dCv92/4uAx0N9DsseXzM8qGl+hxaxGVDLl/FRgTTDA5BCGqUucOBEzi:gV2/4x0NK6Sl+he8//gTT/dBEzi
TLSH
T16F943948DA5390F2E9A384B03646FBBF1521FD308436CCA1F294EF95BA73DA69509317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 135B
SHA256 f28445b68cec9f08e3b27817b45e9b7fef73f9241f8460f2ab728aec040712c6
MD5 a3aa035e2d52495dfeb750f7fa451be0
SHA1 92bec925fc42d02fe7c74e2e480ed29de80ba727
SHA512 cf2df314177366433854c776c78b06ae6e993c6bebe39673fb116f5f0b9d0d2e44c4be94a97edab2ad9e2f46c192989fa284d6dc26992ebb5d599885a6b4948c
TLSH
T1F8C09B4C7009952E115660541C5D557615DCE59CCF095D1C5DD4A4DF575010998E0E63
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 720B
SHA256 d8815ed8e4b087b932047c49d23f759df886a4afa45bb9d9cdae55c971ba76b6
MD5 2a60be117f103b42f7a24704f947875e
SHA1 5ce5f8b65e293e1cc09e0a1940b4a2b644a0a32e
SHA512 c48f411cc1391e74e9dabd017bc85ab4bff52d2cde412223cce505324dbab828149f444b8ad1ff866b16002eb88d54b4023717121c726299702b1443aeab932d
TLSH
T1BD01240DD28FCA2B0102643209BBD11D94A9B89DBF087B189EB0A2CB8748009F4D1B62
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 786B
SHA256 deaa026962de2d776190b20652a434b18d0df9eddaccb66a9c4472846096491d
MD5 b96e3281d7a2405e2d09f31793395e54
SHA1 3aba14877a2ccf88e4a7a20bb7dd5c583ba57086
SHA512 2d52c56cc0263666feec49743caa15b952bac6a706640d34fa56a8f8d44d5875b099a2cd7123abd82b84633927ba5eccf6a9d4f20d06656a976ff293bc795619
TLSH
T16901260DE24FDA2B11066032097BD11D94E9BC9DBF087E1C9EB0A1CB8748009F8D1762
MD5 SHA1 SHA512 TLSH

Submit Download

forwarder.log

Path C:\Users\Admin\AppData\Local\Temp\EsetNupForward\forwarder.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

memory/876-25-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3368-28-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/3440-27-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4948-2-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/5540-12-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads