Overview

overview

8

Static

static

3

0443766709...af.exe

windows10-2004-x64

8

0443766709...af.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 09:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0443766709e5399107515f7495222efd5684266cf0cc0d8b38f005314d0c67af.exe
  • Size 259KB
  • Sample260930-lp2hvst19j
  • SHA256 0443766709e5399107515f7495222efd5684266cf0cc0d8b38f005314d0c67af
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryupx

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0443766709e5399107515f7495222efd5684266cf0cc0d8b38f005314d0c67af.exe
    "C:\Users\Admin\AppData\Local\Temp\0443766709e5399107515f7495222efd5684266cf0cc0d8b38f005314d0c67af.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\0443766709e5399107515f7495222efd5684266cf0cc0d8b38f005314d0c67af.exe"
      2⤵
      • Executes dropped EXE
      PID:1084
  • C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
    "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
    1⤵
    • Downloads MZ/PE file
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe.update
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe.update" --selftest
      2⤵
      • Executes dropped EXE
      PID:5980
  • C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
    "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
    1⤵
    • Executes dropped EXE
    PID:6032
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5572
    • C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4540

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Eupdate Helper.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
          • Size 259KB
          • SHA256 0443766709e5399107515f7495222efd5684266cf0cc0d8b38f005314d0c67af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Eupdate Helper.exe.pending
          • Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe.pending
          • Size 17B
          • SHA256 36333e125324a34bef04c88541211594527cdc234315f45b010d8bfc3bac6b46
          • MD5 SHA1 SHA512
          Submit Download

          Eupdate Helper.exe.prev
          • Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe.prev
          • Size 259KB
          • SHA256 46d491be6911102699bedc62a7a079c314b15e6e6704566009d090b0d8912642
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Eupdate Helper.exe.update
          • Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe.update
          • Size 101KB
          • SHA256 b99b05fa42000e19912cb42915bf17199cce6c94a56d7b40621c4e34d77c252e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EupdateHelper.log
          • Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
          • Size 2KB
          • SHA256 f9cb2d886cd33f8dd3d3fdf0641fd6796977a100ba8453580e5b032ce2cd441a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          EupdateHelper.log
          • Path C:\Windows\TEMP\EupdateHelper.log
          • Size 2KB
          • SHA256 54402aef2076bcca8ebb201cdeef53ddfcac50f87139d16f6524e26d36d8d291
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          EupdateHelper.log
          • Path C:\Windows\TEMP\EupdateHelper.log
          • Size 3KB
          • SHA256 2c9d877148c3f23a1b3742a6f9c228fc0a2279e12755ed7512d214fbabda8252
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          EupdateHelper.log
          • Path C:\Windows\TEMP\EupdateHelper.log
          • Size 7KB
          • SHA256 03e1168654f0dbbb50a5b9457fc2f2d22b1837b9e260e07f9ebed2c569b0db0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EupdateHelper.log
          • Path C:\Windows\TEMP\EupdateHelper.log
          • Size 7KB
          • SHA256 8ab54f446c77f31a779bc2ba0a6f13ed486a9763ca97c7c7ec6f5fb87970331d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EupdateHelper.log
          • Path C:\Windows\TEMP\EupdateHelper.log
          • Size 9KB
          • SHA256 c7b0d0ff5e51b10b5656b5c25617a9287cb0e78187ca16713c370d4056a0ca8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EupdateHelper.log
          • Path C:\Windows\Temp\EupdateHelper.log
          • Size 6KB
          • SHA256 6978853e777e45c9715cf7ac6535974a9124127e595777edcc5b12a70f0011bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1084-40-0x0000000140000000-0x000000014004A000-memory.dmp
          Download

          memory/4540-82-0x0000000140000000-0x000000014004D000-memory.dmp
          Download

          memory/4540-110-0x0000000140000000-0x000000014004D000-memory.dmp
          Download

          memory/5980-62-0x0000000140000000-0x000000014004D000-memory.dmp
          Download

          memory/5980-53-0x0000000140000000-0x000000014004D000-memory.dmp
          Download