6a821338b754e434e122a3ecc028e8d77e2e3a6549bfd070ef60ad2e340aea56

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a821338b754e434e122a3ecc028e8d77e2e3a6549bfd070ef60ad2e340aea56.exe
Size 254KB
Sample260925-yvmccaywat
SHA256 6a821338b754e434e122a3ecc028e8d77e2e3a6549bfd070ef60ad2e340aea56
MD5 096a14808b2dac99f35b2a56f053c88e
SHA1 20e958d77f696ee3cd01ae3595de7d40526ebc3c
SHA512 b657048aa88ee973ad45858d1533492a96d36d8829aafc6c48c50a9051b035c5310ac6f8054174e119f4483d8dc42e625405be9422c8379076104e5d78b875ac
SSDEEP 6144:gj72EsQv9DiquoXgrn4HmvmDPTWLUxv3YhE:g+ho24HmvmrLYhE
TLSH
T17544091BB3E30CFDD66B813586A7D3329932F8250335FA1E1694CB333D61D605B6AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	4328	Eupdate Helper.exe

Executes dropped EXE 3 IoCs

pid	Process
3920	Eupdate Helper.exe
4328	Eupdate Helper.exe
1544	Eupdate Helper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4328	Eupdate Helper.exe
4328	Eupdate Helper.exe
4328	Eupdate Helper.exe
4328	Eupdate Helper.exe
4328	Eupdate Helper.exe
4328	Eupdate Helper.exe
4328	Eupdate Helper.exe
4328	Eupdate Helper.exe
4328	Eupdate Helper.exe
4328	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 3920	1756	6a821338b754e434e122a3ecc028e8d77e2e3a6549bfd070ef60ad2e340aea56.exe	87

C:\Users\Admin\AppData\Local\Temp\6a821338b754e434e122a3ecc028e8d77e2e3a6549bfd070ef60ad2e340aea56.exe
"C:\Users\Admin\AppData\Local\Temp\6a821338b754e434e122a3ecc028e8d77e2e3a6549bfd070ef60ad2e340aea56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\6a821338b754e434e122a3ecc028e8d77e2e3a6549bfd070ef60ad2e340aea56.exe"
  2⤵
  - Executes dropped EXE
  PID:3920

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4328

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 254KB
SHA256 87d9374f668018a25985577bfb358d556ab275b29a7cd5af213795381f5f35c5
MD5 1cb5252b6ea477926573b42746e0d4d5
SHA1 4735b278dd263d13b165a24bfae469de19e6ada1
SHA512 8189fec14064b7bcf7cc05c13eb66fd5beb17bca7eafe003ff30e5ba4a864ddb5043f75f1e934187c19df7b8e0afd496c1da0115ac78c97868d688003032cb1b
SSDEEP 6144:gj72EsQv9DiquoXgrn4HmvmDPTWLUxv3YhV:g+ho24HmvmrLYhV
TLSH
T11344091BB3E30CFDD66B813586A7D3329932F8250335FA1E1694CB333D61D605B6AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 254KB
SHA256 6a821338b754e434e122a3ecc028e8d77e2e3a6549bfd070ef60ad2e340aea56
MD5 096a14808b2dac99f35b2a56f053c88e
SHA1 20e958d77f696ee3cd01ae3595de7d40526ebc3c
SHA512 b657048aa88ee973ad45858d1533492a96d36d8829aafc6c48c50a9051b035c5310ac6f8054174e119f4483d8dc42e625405be9422c8379076104e5d78b875ac
SSDEEP 6144:gj72EsQv9DiquoXgrn4HmvmDPTWLUxv3YhE:g+ho24HmvmrLYhE
TLSH
T17544091BB3E30CFDD66B813586A7D3329932F8250335FA1E1694CB333D61D605B6AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 3KB
SHA256 785402b3e49088226a5960300d1c3bd0c4f0aa4c1e687f2055ecc47cd0f71ec1
MD5 be9df114164df2ead0cefcd8e968d570
SHA1 d54925a9d1cc7819498129313b80825b6071477e
SHA512 1f43708d8ba2f7a2dfbb28219690b96478bdd5b455b0d51f81f0928c712c90b98ab3a6cacfd92000256388dd9d1ca1c1150c8fa91157f7ffff672777c60a0ac3
TLSH
T16451727D1AE80129EBBBDB02E4F7841BB97978A36975CD0C0AC547CC0861605B9E3F5E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 2KB
SHA256 fd9dc456ad6b9f625f25095dad000a876649b826a4c779576a9c24151412949e
MD5 2e8beba5a60e356c8d7c8a2fc343ab26
SHA1 70389f3ac0c845b489b3319614effc82f87f97ce
SHA512 9b94c7038c5b4993e8c7b7a731e2f78192152b59976b4a3b349c1c651fbc51c531d903dabb65af83fab44f6bd58d4877f226f8aec0428c6979a93c3f59dddc06
TLSH
T11251606E1FE90116F7B6DB12D8F2841BE53539A36D75CA4C0AC247CC0875242B9E3F9A
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 3KB
SHA256 5de6539756af44e693c9f55f73259f4747ef73e895eaa9d3bf2f0d65dd8e9f5c
MD5 67ec225935d493672f3c61a61af2d189
SHA1 152a7cd9f65bed2f5398a3909c8839f951d4aa1b
SHA512 9116a355c34dab27b5efa5aeb5ff8d89c67ec6c67747b4ad9e881b0901303e6c2f70dfdfc93907f3270a7c67526606206b502e0fd2924642305e07957a331acf
TLSH
T14271416E1FE90116F7B6DB02D8F2841BE53539A36975CE4C0AC147CC1876242B9E3F5A
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 fb0d821f7557b0e4d0f6868157ec7cbc89eb8bc64dffe1d9d4a71edae67c2308
MD5 dc120a6f2a4660ed9e0c6ee36bf4be54
SHA1 dea4e28343046b67912257f5cc46afb7c6204781
SHA512 bfc3af1bef22ee0e285e90282c3eefdfc9df5dc483041781655de48708b0d63f30cb9fae62125ae203d896020d43d8e78b74c92eae2de003ef578ab348a75acd
SSDEEP 48:Fsles7Nzf5suYnHlsaLfVwsbVwsAVwsmVwsXM2lVwssYHVwssyXFVws75I4Ee4Ln:incNMwGyJqqYfHLYDVb4LcvUwJNM
TLSH
T1A8A1926D1FE90116F7B6DB02D8F2841BE53538A36D75CE4C06C247CC1876642B9E2F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1544-59-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/1756-9-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/3920-41-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/4328-58-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/4328-63-0x0000000140000000-0x0000000140048000-memory.dmp

Download