ef8ad8d50cb438f11d88c71c2fd8a0ca74a463b712c5186b4a69197c3ff4ae08

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef8ad8d50cb438f11d88c71c2fd8a0ca74a463b712c5186b4a69197c3ff4ae08.exe
Size 259KB
Sample260930-xltjmaxs6m
SHA256 ef8ad8d50cb438f11d88c71c2fd8a0ca74a463b712c5186b4a69197c3ff4ae08
MD5 4ea560360ec9eac30d460aeff08cabd1
SHA1 4bc94ae57ad8c58c8477bbbe670172d8bd400b7f
SHA512 0c27203e8db7150d1226ce636130e15a97b70744f49149b414dd6443d4acf8f4b3ce12572f83fd9446f2986d392ca26cc59ff949e06473a239b01f612d449a96
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeh:FnWHTc5n1oS8CQxeh
TLSH
T18A44091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4280	Eupdate Helper.exe
5012	Eupdate Helper.exe
1296	Eupdate Helper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5012	Eupdate Helper.exe
5012	Eupdate Helper.exe
5012	Eupdate Helper.exe
5012	Eupdate Helper.exe
5012	Eupdate Helper.exe
5012	Eupdate Helper.exe
5012	Eupdate Helper.exe
5012	Eupdate Helper.exe
5012	Eupdate Helper.exe
5012	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 4280	1592	ef8ad8d50cb438f11d88c71c2fd8a0ca74a463b712c5186b4a69197c3ff4ae08.exe	88

C:\Users\Admin\AppData\Local\Temp\ef8ad8d50cb438f11d88c71c2fd8a0ca74a463b712c5186b4a69197c3ff4ae08.exe
"C:\Users\Admin\AppData\Local\Temp\ef8ad8d50cb438f11d88c71c2fd8a0ca74a463b712c5186b4a69197c3ff4ae08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\ef8ad8d50cb438f11d88c71c2fd8a0ca74a463b712c5186b4a69197c3ff4ae08.exe"
  2⤵
  - Executes dropped EXE
  PID:4280

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5012

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 ef8ad8d50cb438f11d88c71c2fd8a0ca74a463b712c5186b4a69197c3ff4ae08
MD5 4ea560360ec9eac30d460aeff08cabd1
SHA1 4bc94ae57ad8c58c8477bbbe670172d8bd400b7f
SHA512 0c27203e8db7150d1226ce636130e15a97b70744f49149b414dd6443d4acf8f4b3ce12572f83fd9446f2986d392ca26cc59ff949e06473a239b01f612d449a96
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeh:FnWHTc5n1oS8CQxeh
TLSH
T18A44091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 b6e0202c5e1cedf0e8c0f9c19f9f48def900c5589802bfddcf785d44d8020fed
MD5 a66ac8e55b79f26ee8e63629d7a3d8df
SHA1 61f4f75aaa6ecae42d9d876e702741e67eaa84c4
SHA512 69679e91e2d5c9f5eb499e6bcf1d3b702703660444866e08dadbc1300776673def81ac3b2f18b26cf2b135ce3cb0500ffcc9c79aedeb255f57b2f3534d13fbe4
TLSH
T1B241D6691EE81576E7BBC942D8F6540BBA7679923D35D80C06C203CC08A2B15B9E3F5E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 3KB
SHA256 17b5e84202b26fca53482510141ddd07003d638fb088fbbfd2660cf10d73c553
MD5 abaa466f457c383e2d6accdb142dddcd
SHA1 9ad53287aac5335ffffe8c35267d11d8cb990cb2
SHA512 243305daa2f4647cc04a34136de9263d3629dc868f489de94627b4ed9c41dcc92965d5015a7482e48de6186224adf08f164cee97c5a7a0256df785672f595a78
TLSH
T1107152291BF80671F77BDA02C4F3A81BB53539566972D90C12C243CC09B2640B5E3F6E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 2KB
SHA256 dee710c5df1d2e59b0d99a5e0e94df2d906f7ab81c28687626e758696e9baa89
MD5 c5f8059568bc3d0ecd7b74945fe89662
SHA1 e60ec0447a47b8242f3c686c9d8adcb01d14261c
SHA512 3be985a56b51990cf0eccb6a751bc2be90a2d5a911cdb363aa36987cbc2159f23c275c0fa5afd798f19d38e5be81b68ddc1d3c3eb6277ec4c1fa6e2fe3647720
TLSH
T1505142691BF84661F77F9A02C4F2A41BB53579926D76D90C12C243CC09B2600B6E7FAE
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 43ae93fad1fb314f4ede0e388e4e426cf898e3db485980f6bf639d0791d106c6
MD5 ab0410f2937853bc3aed84c09a2a99eb
SHA1 7ec682c43b914aedd27bca6d0802728bc98a1278
SHA512 f78b1863c5d67abd405f6b2c09fde005ca16c7d14b0b0686faf45f081e1c759f0b7f93d806b65852b58e2ea9fb05e63f81f5d0163455a4fd736670fb9e61a63a
SSDEEP 96:rC4k4rpNSFwM8OZiwo8+q4NzryJGNbLJJAsPqPBazmMLwpx+AM:DVlPVabM
TLSH
T1D6A150291BF84661E77BDA07C4F3A41BB5353946AD75DD0C12C243CC0AB6601A6E2FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download