8baeeb7253aef41848b5c8d924511825d2e42171315c0445d844e31dbac3f421

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8baeeb7253aef41848b5c8d924511825d2e42171315c0445d844e31dbac3f421.exe
Size 259KB
Sample261011-18xrcaaa66
SHA256 8baeeb7253aef41848b5c8d924511825d2e42171315c0445d844e31dbac3f421
MD5 f9911866bcc2c34c87eedc3f13f4cb7a
SHA1 ec5c3aa167fe21091ced15b6e6ef92c36dbc19dd
SHA512 2c2b4b5d4a3cd23c661a1be5a1801ec644e6eda7aaf05d075d71b2f9f1c0c819d510710cbd19ce334ce69605c361ffcc6edbf7ed9cb91fba6fb927193d43fa6c
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoef:FnWHTc5n1oS8CQxef
TLSH
T10A44091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3820	Eupdate Helper.exe
4640	Eupdate Helper.exe
800	Eupdate Helper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	Eupdate Helper.exe
4640	Eupdate Helper.exe
4640	Eupdate Helper.exe
4640	Eupdate Helper.exe
4640	Eupdate Helper.exe
4640	Eupdate Helper.exe
4640	Eupdate Helper.exe
4640	Eupdate Helper.exe
4640	Eupdate Helper.exe
4640	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3820	2440	8baeeb7253aef41848b5c8d924511825d2e42171315c0445d844e31dbac3f421.exe	89

C:\Users\Admin\AppData\Local\Temp\8baeeb7253aef41848b5c8d924511825d2e42171315c0445d844e31dbac3f421.exe
"C:\Users\Admin\AppData\Local\Temp\8baeeb7253aef41848b5c8d924511825d2e42171315c0445d844e31dbac3f421.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\8baeeb7253aef41848b5c8d924511825d2e42171315c0445d844e31dbac3f421.exe"
  2⤵
  - Executes dropped EXE
  PID:3820

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4640

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 28b6cd76cdc4509edd92e43fa4d1f9cf32697e77034ff96580e5b96407a1f9fd
MD5 13fe798b575e53fd89c54be2b8702991
SHA1 65a5b0d67ea8dea5b3002027a090ba1e9f7ca27e
SHA512 a8af92722246e0d9e1db4b827209d586003702ecb3c79ef72f3ec6ef4442d80ca026a0daf386b499921378d4b71a4e5684f4b62dba5f3df7289fd61d4a084b74
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoe1:FnWHTc5n1oS8CQxe1
TLSH
T1B244091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 8baeeb7253aef41848b5c8d924511825d2e42171315c0445d844e31dbac3f421
MD5 f9911866bcc2c34c87eedc3f13f4cb7a
SHA1 ec5c3aa167fe21091ced15b6e6ef92c36dbc19dd
SHA512 2c2b4b5d4a3cd23c661a1be5a1801ec644e6eda7aaf05d075d71b2f9f1c0c819d510710cbd19ce334ce69605c361ffcc6edbf7ed9cb91fba6fb927193d43fa6c
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoef:FnWHTc5n1oS8CQxef
TLSH
T10A44091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 1KB
SHA256 05b2200a65b33291b2ae40bb4b1e7b7ab665278d9d7342ba4dac9f141cf11911
MD5 0b49ee08ba16011bd9fa581648528614
SHA1 1789fabbe3cc8c151f8dd0ebfd2772a855e4fa14
SHA512 262af2b6b4dc9c99e4f6f04d82c1704e693d1665835380faf272716e536e3b45424956b6d96e6da858fdc0589865335ea46733a21485ea483fbeff8cd26cb8e0
TLSH
T10B41CC2E15E4019ADBBBD707ECFB001BA8797C6269359D0D06C257CC0C62A05B9D3F9E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 866B
SHA256 85c469ce89c8f3b194efcf02b7ece20593e541a6461c720664760c1db3d5dc29
MD5 7b5b8e75581cf5aa21d572e11d75184f
SHA1 3bcff96af0a36d2615de42cd621c94dbb68c32b1
SHA512 798043b553352d17fb2f5e68e89503a42d483a081711b498701d2e2100bd53ce01a4920b35158e32c11265b3cf7dfbe94c183e1e09f1483d4c146974423b46e4
TLSH
T14E11B52E15E4009BDBBBC607E8FA011BA47978A368399C0D06C61BCC0C61A04B9D3F8E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 1c915f7176250c76624c570b8fde7f92043ff61aa0159530c74597e77daad39f
MD5 749c38eeb5b5fe3754ac990223edf5b3
SHA1 4debc64ab029e746b1b7b5768d878bd069398524
SHA512 2cb4db78044d07f0cb20844701c4cb9a47e6b0885b57d1040d69c5467dd9aa3bcd10205275a50b84dd5764e7153d19c82764894b511da0f7e76ddcd921f7f849
TLSH
T1AB41DC2E16E4019AEBBBCB07E8FB041BA8767C5369359D0D06C257CC0C61604B9E3F9E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 3KB
SHA256 2c0e14721321daa5a636a2894e270dacc8fd86b04897542cf5de1ce999827cc2
MD5 e2ca73d4709be48058b451fe97c72676
SHA1 7b5f566bd719e101c54b0d9a08473a321ddbb2f4
SHA512 cbe1c9ec86888509480ee5df3cf05b0ca1d9aef3da90aa92260b29652067977453c87b9c1e587ef92506d04b772c51bdbfbc32e01639f05b2e8737cd2ac7d615
TLSH
T109716E3E27B40286EA76CA03D8F7840BB63579966975D94D42C247CD1C71500BAE3F9E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 2KB
SHA256 a0334a64c3085feeaa6c2420b737c4b47db96dbe7038fdeb681df384d909e7d3
MD5 b9c11da3ee2d447e5ce10e7951ffa615
SHA1 c082dbadf492f8aea794d7a2460b650b4a797980
SHA512 62a3fbbf4ba79ac0a5e934695f8d9a6b60c6abe6865da767bfdf82b7bc740c21706e7302f9167ad07be7cc8729d9d2cd0192c2bc831c52dad8e9382368f94215
TLSH
T17D416C3E13F40686FA7ACA03D8F6940B7A353C566935D94E42C247CD1C71500AAE2F9E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 2KB
SHA256 f70e2ed4a7ff6371871e82dc2c7360902e773a851885ac26166bf02f8e966db6
MD5 f33d9ee009702a5ab65afe5ed9ac0e21
SHA1 dea660987aa38cd5bf86847d519b2539fa4a164d
SHA512 78725da54b01e558bfb99a13904bec9c160b8d7273d320aa78b8da72b2031b9e35da0dd327482d41e5bb66c3474111be2ea4017e156a1815ef43f552eb7a5bf1
TLSH
T115516E2E23B80186F6BADA03D8F7840B79367D966975D90D42C247CD1C71500BAE3F9E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 b892713df89deca1567f74921726a342ef3896fcba17d7a9840432920d436221
MD5 a67cbe25ede1e3804c6f2f2f31408364
SHA1 a5e67634f184ea17bcdb58837a1e9882b47890a1
SHA512 7a7ffc22e67fe838a27c232db7094a2f6183a14708b0d9ca349fbb2701f844d72acd9577dc4171e98c5511a2859ea46e3c6184ae2c0b0e6a3f2c6a082b1aa597
SSDEEP 48:DU0e0YnHMLMM2/YAPwZ75Zo0MwYnH+L/xfNbkCW5WPqTohNmhcwXCdITM:D0ZM/4wLZ6SZNb7W5WPqTobmhcwXLM
TLSH
T162A17F3E17B40686EA76DA03D8F7840BB6353D86A975C90D52C24B8D1C71501BAE2F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download