4244aabad5c7a06e475d096e6ea96b040ef7fd43d9b8082a85a4a8b7833b1747

Analysis

max time kernel
152s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NHelperV4.exe
Size 195.2MB
Sample260727-plw1raswdv
SHA256 4244aabad5c7a06e475d096e6ea96b040ef7fd43d9b8082a85a4a8b7833b1747
MD5 be8823a31ffdceac035ed5362e62e430
SHA1 08dfecab55d511338b91115ad898275e1719be05
SHA512 b366e10a3121b818906a4a00ad80a25aee784b1a4e4328fdc6e64f3e049acf51eee70f1f6254ae90a11443b58702511d6bffe930ab43d85df30473e37b91b6ae
SSDEEP 786432:mwHz3ODmtjw1rHi/PEEpjelfNTDA2y06OlgflKUsExM3RfbmYEyGUqzDTjzNiJID:LHyDmyU/ComlUo9aYDGnzDTjzNQID
TLSH
T193A88D0163E80A15E67F8678D6B24261DB75FC425711C2CF0494FA5D2FB3BC2AA363B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2592	NHelperV4.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NHelperV4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NHelperV4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	NHelperV4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	NHelperV4.exe

C:\Users\Admin\AppData\Local\Temp\NHelperV4.exe
"C:\Users\Admin\AppData\Local\Temp\NHelperV4.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nwaxf1d4.newcfg

Path C:\Users\Admin\AppData\Local\NHelperV4\NHelperV4_Path_vdd2zqaix53s53mywmb4qqlnvwdekwsb\4.2.0.0\nwaxf1d4.newcfg
Size 1002B
SHA256 ddee20ee953521b1cd9928cb3b802f8cee94ab39415e0901929886a87ea2b0d0
MD5 7534e1a8244ed0a2ee919c37217b4ceb
SHA1 ea4ec84092eaff459b9819c43e7cbcce5011c363
SHA512 8b2327f0a2436e8bb73a7930956a1447cb28c8dbdef6d774c955b3be7c2c06441392d10ddc2ea8731eef45963fe1fc208532c96bdb7934239a09842643bc04a0
TLSH
T197118C0532C07E6B01232B33D5114641DEB413A346692868F4BE72778F794CA07C3376
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\NHelperV4\NHelperV4_Path_vdd2zqaix53s53mywmb4qqlnvwdekwsb\4.2.0.0\user.config
Size 883B
SHA256 190b493254d2b4d11c9edb215550adff350c4be5b1cf322fab429a45bbf45095
MD5 3be00bb29f23590fc86f49b98141d2b4
SHA1 0af99a0d5e167335bacb453be67a584fe52eee50
SHA512 1baf4e3c385557864d98af21b22c3861cc2856ffafaecfddfa6e782776e741a1d0dd085200965aa0de0bc56bc83db4d5ed844a04ca067f792e2d3e21aa941078
TLSH
T11511491122847E6B01232B33D5469641CEB453E74669296CF17E72778F7A4CA0783376
MD5 SHA1 SHA512 TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\NHelperV4\xTrkhz0vs0LOWnK9qn2oZWrGE+v5dRo=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 4f8ac54f5b28a6a9251224c7ede89ec9ba67946a011a9480f22a7f3002cfac5a
MD5 0d85ea41722d9ca45680e05ef86ee055
SHA1 70ceb7df806e5098390fb0b9b001f784a08138e9
SHA512 dd152d2419d724cea5395be496c5c53befa3865f19c76270d4def2bf9c982fad4ff9fdc42b56b195b76c40a46f21df52b30eb4dc064040e38af5e7b5b68d798a
SSDEEP 24576:XgaltAn1r1sE33slrVCP0QSeDOM8zT3n6kcNbNUdah6ox3GmOBlIefATbpwwPAFm:anR+g8lYP00OM8zT3GbNUdvoxWZBlIu4
TLSH
T193453A22E2E642E5C47FC1B8C6469717FBB1740A131C66DB87608B652F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads