39ca43d030dc50995ad9c1acfdfa9a30b1b62ff6a2f833ceb3d61e8b9452c902

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39ca43d030dc50995ad9c1acfdfa9a30b1b62ff6a2f833ceb3d61e8b9452c902.exe
Size 254KB
Sample260925-y3bktawcnd
SHA256 39ca43d030dc50995ad9c1acfdfa9a30b1b62ff6a2f833ceb3d61e8b9452c902
MD5 c40ab7c450723810605381cc1a3cbb2c
SHA1 a47ee686fb324356a0a50e0c696fd62ab9b0db42
SHA512 2749418701c5f3dae3e5dbfce2d06aae78121d043290c0bfeac139e5fdd1a8328ab0a3e2f663f30d1ff697637126ccce5d895613491913174edaa8606549fe8d
SSDEEP 6144:gj72EsQv9DiquoXgrn4HmvmDPTWLUxv3YhJ:g+ho24HmvmrLYhJ
TLSH
T19F44091BB3E30CFDD66B813586A7D3329932F8250335FA1E1694CB333D61D605B6AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	3184	Eupdate Helper.exe

Executes dropped EXE 3 IoCs

pid	Process
2392	Eupdate Helper.exe
3184	Eupdate Helper.exe
4896	Eupdate Helper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3184	Eupdate Helper.exe
3184	Eupdate Helper.exe
3184	Eupdate Helper.exe
3184	Eupdate Helper.exe
3184	Eupdate Helper.exe
3184	Eupdate Helper.exe
3184	Eupdate Helper.exe
3184	Eupdate Helper.exe
3184	Eupdate Helper.exe
3184	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2392	4076	39ca43d030dc50995ad9c1acfdfa9a30b1b62ff6a2f833ceb3d61e8b9452c902.exe	88

C:\Users\Admin\AppData\Local\Temp\39ca43d030dc50995ad9c1acfdfa9a30b1b62ff6a2f833ceb3d61e8b9452c902.exe
"C:\Users\Admin\AppData\Local\Temp\39ca43d030dc50995ad9c1acfdfa9a30b1b62ff6a2f833ceb3d61e8b9452c902.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\39ca43d030dc50995ad9c1acfdfa9a30b1b62ff6a2f833ceb3d61e8b9452c902.exe"
  2⤵
  - Executes dropped EXE
  PID:2392

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3184

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 254KB
SHA256 705942e05fcb4902333aa833ca1198c5d58b5f31e7d918846e6c1f608640128a
MD5 fae61719109c7cd59e89c00f678cf789
SHA1 fa4f59e1cc1d8e9253d3370f190b77dca29b854b
SHA512 817ca0882ac9ccc5d1370b90e5354f1611bebcdcd533323bb4f27baa01743a8b10bbb408277e3ff5f685f81b2b5c8a911e2d7dcab8c2ef2c04ef5995807263e9
SSDEEP 6144:gj72EsQv9DiquoXgrn4HmvmDPTWLUxv3Yhh:g+ho24HmvmrLYhh
TLSH
T17944091BB3E30CFDD66B813586A7D3329932F8250335FA1E1694CB333D61D605B6AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 254KB
SHA256 39ca43d030dc50995ad9c1acfdfa9a30b1b62ff6a2f833ceb3d61e8b9452c902
MD5 c40ab7c450723810605381cc1a3cbb2c
SHA1 a47ee686fb324356a0a50e0c696fd62ab9b0db42
SHA512 2749418701c5f3dae3e5dbfce2d06aae78121d043290c0bfeac139e5fdd1a8328ab0a3e2f663f30d1ff697637126ccce5d895613491913174edaa8606549fe8d
SSDEEP 6144:gj72EsQv9DiquoXgrn4HmvmDPTWLUxv3YhJ:g+ho24HmvmrLYhJ
TLSH
T19F44091BB3E30CFDD66B813586A7D3329932F8250335FA1E1694CB333D61D605B6AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 06d58fdfaf3ec833369fd5c6f4de471927fb911f7e22ffd5b11c345dc4c68553
MD5 d41bcf3021129bacfa5e05b9312a8b7b
SHA1 e4e57345d87d2dbabf1797d3af07cdaa3988b7a0
SHA512 9bc53f20bef0928f6bce68f3d419fd23ff47c324b9a26f71cb7db4ae27392c7a284ac0e24fdb72f62005bbfc6ae5208c5cf17a04713e6d335934197f2e53466a
TLSH
T10E41922D1EE81126E7F6DA42E4FA441BB97574A32D36ED0C02C207C808A1709B9E3F4D
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 2KB
SHA256 8f4d12af8be809f1dc4c07de2d64c0825ac7c76121d85c7bc38e5545abde136c
MD5 7f17820cb92bb0fc29b7c32bad5ea961
SHA1 6c0e5a05add035ad4b147388a1461a4bb598e1dc
SHA512 fc0724c0b932afceed815f52c8155447547ff35cc2bed15c5085c47cec2b769d2dbe7d5fcd8a7cf9424b925e158ac5521d95ee96faae540bfbede3bcbd339930
TLSH
T19F51742D1BEC0112F7B69942D4F6441AB53579A36D72DD0C02C207CD187264AFAE7FAE
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 3KB
SHA256 3c36a4eda6e7d7b0f99718ec1ef11c734561974416da861bff38001cec61986c
MD5 cdb45fd8e5375c31dace4ba9ae3f858c
SHA1 13d2f349dc6c63c076627d4159d45048423bdda6
SHA512 de6002bbc468d44fb6be94bc97a5df9b365a5f0da7307363e827bf24bf43d0b4f27cc592eac1ea3d2c80c2335288873e1fed5f2b75dacc2c0c6d3001dfbeae48
TLSH
T1AD71A32D1BEC0212F6B6DA46E8F6401AB53535A36D71DD0C02C243CD187364AB9E7FAE
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 8034c8304a40b009413bcecbb55c6b8cf03c8113b9e1a4bd73530fe86d29085d
MD5 2c966560887a011dc983568974fadfd0
SHA1 5b91e87e355a94f965265dc26e4da6c1e19257e0
SHA512 5a8e4ad535eaa954afa0ee75dbeaf26e7fc0c61bdcdb0debac9a852129735e89043315b3a027d6a699d4e0fc4c86b3a41c487387f23b2b3a492feaeb3755ff2e
SSDEEP 48:FteDNu5WYnHliLfwq2dM2luYH7PwZwJ5I+1e4+N154FYnHl4JLPZfZ9kZ9Y0YDjH:X/VMEjw0VaAYLYDDbZf1woCM
TLSH
T164A1B43D1BE80112F7B6E953E4F6401AB53538A36D75DD0C02C247CD187364AB6A6FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2392-37-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/3184-56-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/4076-6-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/4896-57-0x0000000140000000-0x0000000140048000-memory.dmp

Download