7dd92c89acf9b01cb078f7c6eb62ff0fd7263a57f1a6a7b31afbcbc32c164545

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7dd92c89acf9b01cb078f7c6eb62ff0fd7263a57f1a6a7b31afbcbc32c164545.exe
Size 259KB
Sample261001-j15csazte1
SHA256 7dd92c89acf9b01cb078f7c6eb62ff0fd7263a57f1a6a7b31afbcbc32c164545
MD5 5134be043c79b9752456b46b126716ea
SHA1 3cce595d792c64ebe0a7fa9e65f7288ec30156af
SHA512 d19b137c8e8ae6fc43d75db94ad81d68c0abf48d209ccd6ce0551281e106303ace27a2c58d8f7e1816d2e1ab1f170647b71f1bde204f1be306f49f61f80316fe
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeS:FnWHTc5n1oS8CQxeS
TLSH
T14944091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3352	Eupdate Helper.exe
2988	Eupdate Helper.exe
2928	Eupdate Helper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2988	Eupdate Helper.exe
2988	Eupdate Helper.exe
2988	Eupdate Helper.exe
2988	Eupdate Helper.exe
2988	Eupdate Helper.exe
2988	Eupdate Helper.exe
2988	Eupdate Helper.exe
2988	Eupdate Helper.exe
2988	Eupdate Helper.exe
2988	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 3352	3652	7dd92c89acf9b01cb078f7c6eb62ff0fd7263a57f1a6a7b31afbcbc32c164545.exe	87

C:\Users\Admin\AppData\Local\Temp\7dd92c89acf9b01cb078f7c6eb62ff0fd7263a57f1a6a7b31afbcbc32c164545.exe
"C:\Users\Admin\AppData\Local\Temp\7dd92c89acf9b01cb078f7c6eb62ff0fd7263a57f1a6a7b31afbcbc32c164545.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\7dd92c89acf9b01cb078f7c6eb62ff0fd7263a57f1a6a7b31afbcbc32c164545.exe"
  2⤵
  - Executes dropped EXE
  PID:3352

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2988

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 7dd92c89acf9b01cb078f7c6eb62ff0fd7263a57f1a6a7b31afbcbc32c164545
MD5 5134be043c79b9752456b46b126716ea
SHA1 3cce595d792c64ebe0a7fa9e65f7288ec30156af
SHA512 d19b137c8e8ae6fc43d75db94ad81d68c0abf48d209ccd6ce0551281e106303ace27a2c58d8f7e1816d2e1ab1f170647b71f1bde204f1be306f49f61f80316fe
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeS:FnWHTc5n1oS8CQxeS
TLSH
T14944091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 04299ca59930eaeb0a35cacbc06fbc49be9e7f74752ea242fac43f7a8b40d5f0
MD5 2b227f4d33c264fb5b5dd6cb484289ac
SHA1 54c8bc149f3588064842b76d3773b9e5b22974e5
SHA512 8f7e6ea603fb0d39e98acb5ef2d9225b17952ed538e063476c6b1aa854de9c61e9f3eca91747de9601aa47030aaefa49c041c00f049df164123445fa2ab05be9
TLSH
T13F41C72D1E981176FBB3CA56E4F7805B7979F99279358D0E02C047C81D60B24A9E3F8E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 2KB
SHA256 84908311a5df55cefa90c8b9fae063469020cbbc5a7bcf518d2d3b48bb6fd4ef
MD5 05fc20350513a9b09f9e684a88cc40f5
SHA1 6608dd820083fd2f7ba7d856c886861831b9ee2c
SHA512 b608f634ea2d78df4ae67f5e9a501e0b92dc5c002cc4796b38b4eed23c93b1fea0e7fd9735d93e5ec596b3ae2c3bc217605e41c34739ce1beaabb35459b1f030
TLSH
T18351922A1FE80131F6779A03D4F6842B78393995AA75CD4E02C187C91DB2361B6F3F5A
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 3KB
SHA256 56b10e3bbc3dcfc05889a8e3026d54155955a05a3a6e5200c0c13973d445a188
MD5 909255f432d06ce5df909dc3ea5d92de
SHA1 35aa340d36d86eebcebb711b6ba3272289746b5f
SHA512 8d17c9b4fc38d4bfeb250d9de2026bbdbcbb424762a252a58819a08c3f4dfd330ae9c9206f2cb2ceebdc3147c45230bf08a9e8f450ed16624f9d272cd76ad03d
TLSH
T16271922A1FA40132F6779B03D4F6842B69393985AA75CD4E02C187CD2DB2312B5E3F5E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 2KB
SHA256 f6b20ec31b665e49c078320c50db1ff1389bc8d3d741b2554637cedbe54f3fa9
MD5 a3ec0d9ce344f06d6ee869edfd9387a7
SHA1 c25e4df00fa03b9b26cd6588ea358d1937676511
SHA512 ee890e33b0ed61fe8c941bcc647821e17070d7bbe5d0735382af88a3be807337c1ab873c69ee33b2a19fa262774c4efb61cd93459721f83891b1da5bb045e4eb
TLSH
T19751942A1FA40131F6779A03D4F6842B793A3AC5AA75CD4E02C187C91DB2321B5F3F5A
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 cf35dda34ba2e66200e6f11198bd21720f17ba6132a0a044fd6c20b26887a1f5
MD5 0259efc34713d9fba377b2d2f89c860c
SHA1 4ae897af91ef9e975e3a968f8e33a1c2d48a53d9
SHA512 2f770e575d427cb1ca638fa26d3b08b682bbb1a22c52e481769301f586fef7bbf74bf44f44e6cce1c2a1279cc6b414bb57b7320e6dca4ab8ce61a05cdf046c38
SSDEEP 48:zE0l0YnH8LpM2KY9PwZj20nf55YnHwLMfNbkYzPqoh0swRCd2TM:zRcMilw9fGVNbxzPqoiswRlM
TLSH
T14EA1822A1FE40131F6779A03D4F6842BB9353985AA75CD4E02C187C92DB3712B6A3F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3352-40-0x0000000140000000-0x000000014004A000-memory.dmp

Download