9c3202db2f0217415153ba3b85f0f4aef98da76ff12193de2ac51a9fec8b307c

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c3202db2f0217415153ba3b85f0f4aef98da76ff12193de2ac51a9fec8b307c.exe
Size 59KB
Sample261011-1nttyshe66
SHA256 9c3202db2f0217415153ba3b85f0f4aef98da76ff12193de2ac51a9fec8b307c
MD5 1f92953fa951cda0077500ecbdca23ed
SHA1 49e713a915c46daa6677051db05108cf2b66e387
SHA512 22bad88d9c24ea870fe3208433f74b62b3b9821e7c8bfc1430fd5302230d2585b28deb5505132497782f91c089e9821ff3b9fadf9d7e9d545afe851b7d862ea9
SSDEEP 1536:RJsXcv+bxpkmitg1IxdsHfRhx83US4HRiV:RL+bxmc+kHfrx83SAV
TLSH
T12F53F1A9A4A48F3EE8D7FAB2DFB542749C3539FA4F4A42250F0D743E5779A800A73141
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5140	Eupdate Helper.exe
5780	eup_rotate_5140.exe
4652	Eupdate Helper.exe
4112	Eupdate Helper.exe
3196	eup_rotate_4652.exe
5928	Eupdate Helper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eupdate Helper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Eupdate Helper.exe\""	Eupdate Helper.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5640-0-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x0007000000011392-2.dat	upx
behavioral2/memory/5640-4-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/5140-10-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x0007000000011392-17.dat	upx
behavioral2/memory/5780-19-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/4112-26-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/4652-27-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/4652-41-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/files/0x0007000000011392-42.dat	upx
behavioral2/memory/3196-50-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/5928-51-0x0000000000400000-0x000000000042C000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_5140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eup_rotate_4652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eupdate Helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c3202db2f0217415153ba3b85f0f4aef98da76ff12193de2ac51a9fec8b307c.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 5140	5640	9c3202db2f0217415153ba3b85f0f4aef98da76ff12193de2ac51a9fec8b307c.exe	91
PID 5140 wrote to memory of 5780	5140	Eupdate Helper.exe	92
PID 5780 wrote to memory of 4652	5780	eup_rotate_5140.exe	93
PID 4652 wrote to memory of 3196	4652	Eupdate Helper.exe	96
PID 3196 wrote to memory of 5928	3196	eup_rotate_4652.exe	97

C:\Users\Admin\AppData\Local\Temp\9c3202db2f0217415153ba3b85f0f4aef98da76ff12193de2ac51a9fec8b307c.exe
"C:\Users\Admin\AppData\Local\Temp\9c3202db2f0217415153ba3b85f0f4aef98da76ff12193de2ac51a9fec8b307c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\9c3202db2f0217415153ba3b85f0f4aef98da76ff12193de2ac51a9fec8b307c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Users\Admin\AppData\Local\Temp\eup_rotate_5140.exe
    "C:\Users\Admin\AppData\Local\Temp\eup_rotate_5140.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 5140
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
      "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\eup_rotate_4652.exe
        
        "C:\Users\Admin\AppData\Local\Temp\eup_rotate_4652.exe" -standby-mutate "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" 4652
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" -no-rotate
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:5928

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 1fa5f924df07cd4268481271fcd942cfd83a136cf468d45c8f765831b5abe2e3
MD5 95a970bd9109990cb8bd7d8748a4b796
SHA1 7588fe237b9867ce3f299dc482b6e833cc451828
SHA512 ba7b7a3d23b1d9bd10cb75fd8abaf100462276e6df7e21c52cac3c6323ca3f2d9dba9024f4ad1610fb0e3fea96a3d3750d8fe07b0487bcc37a571a5c5e208346
SSDEEP 1536:RJsXcv+bxpkmitg1IxdsHfRhx83US4HRiK:RL+bxmc+kHfrx83SAK
TLSH
T19A53F2A5A4948F3EE8D7FAB2DFB542709C3539FA4F4A42250F0D743E5779A800673141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 9c3202db2f0217415153ba3b85f0f4aef98da76ff12193de2ac51a9fec8b307c
MD5 1f92953fa951cda0077500ecbdca23ed
SHA1 49e713a915c46daa6677051db05108cf2b66e387
SHA512 22bad88d9c24ea870fe3208433f74b62b3b9821e7c8bfc1430fd5302230d2585b28deb5505132497782f91c089e9821ff3b9fadf9d7e9d545afe851b7d862ea9
SSDEEP 1536:RJsXcv+bxpkmitg1IxdsHfRhx83US4HRiV:RL+bxmc+kHfrx83SAV
TLSH
T12F53F1A9A4A48F3EE8D7FAB2DFB542749C3539FA4F4A42250F0D743E5779A800A73141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 59KB
SHA256 ab17311df34deab22003687b7ad718f5e010b747c4e41fd57a2cf945fda2f018
MD5 519823d68a9dfe84f9ed7eff3dcf2e51
SHA1 97ab31c0ed0f356ad88de01620c2aa8b1128ed1a
SHA512 568c8e2fa284238e23c7619242b38fa550ed5470b43a85c4178af42120f5407b92497923c3d48029e72b7366b982babeaf283901163f3e84d346a613a6a8ed5a
SSDEEP 1536:RJsXcv+bxpkmitg1IxdsHfRhx83US4HRiS:RL+bxmc+kHfrx83SAS
TLSH
T19A53F2A9A4948F3EE8D7FAB2DFB542709C3539FA4F4A42250F0D743E5779A800673141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 710B
SHA256 e598a7a1d1f4f92ab2fb86a1682791c680f167d420e92dc299375616ed2ccf2f
MD5 4e8b87bc1facee85705e17ea7dace4c2
SHA1 be62d303a9b57f598bc720a73c13df7c72d28bb8
SHA512 739f6e06ef718eeac96f97cd1824aa4ea2526f32b5b8f30dce4b6e5b856f3a44f12c788ceb43d1754df00f276b0534ca01469eefb564d80400808bfaf1fc7304
TLSH
T1EC01812F9EE51116D5B3DB0369F340121B727EA66839E80D03C04B8D1CB2604E830BAF
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 920B
SHA256 4e58de6fecdb6f495a864b437811b14624e0018376558cb6dbbd428adc29e314
MD5 aebbedbb6c96c7d6a7903f04a186e9ef
SHA1 34cea2d89d6a9ff7f177da70856ca993fe755586
SHA512 4a6d70fca8fa4164b3c20c5851266f8e3fafc82ce3ccf6e9cdc7bbd97050ff0d0083d6454c296274a5f87887a641bef5cfddea70c5a542d0777529adc00e529a
TLSH
T1AA11843F5EE51116D6B7EB0369F780111B767DA66839E80D02C08B5D1C72614E930F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 6c4953e28fbd4182c4c14f0ffd815ae247e0c9c84815db3ac2c768efc135e58e
MD5 a62517b41440f4737fccd23a8dbdb348
SHA1 8deb7d8e1ee50cde107f4bb72571b10d556c5209
SHA512 d8caeeaabf2dc1ac7f70a41c5f24938659dd110e70d0376be5875fd0eb259b1099905a349281e840e5dd4d493799fdb8eb58dc320a3d2ff2638ca4cc015cdc4a
TLSH
T1D0215E2E9AE4111AE6B7EB07A9F740152B72BDE66839D80D02C04B5D1C72614E870F6F
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 1KB
SHA256 627b99d2c69314c87e2d02af21498391b755210a2b0a136f802da3bb56e0d249
MD5 0c7df442c298dc3505bf112a9960b947
SHA1 c2bcce066ed422dd735d88674c34602c8eb4d9fc
SHA512 85eb99052b97dbdb24860b0ab8c70a4123aa15eabeee23796f9fb46f1b29ca0bcdd3938554387a33a826e5305036cd8a385c82609983caee5c1ca37022447f34
TLSH
T1BE31A12E5AE0011AF6B3DB07ADF740162F76BD966839D80D02C04B5E1CB2614E874FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 e294165d820514c54024fc145e2f53fb4f9c786ebb36c40e5b5ffc8fc4f9118c
MD5 1560e1ecd3157f183b6e99eacf5d6aff
SHA1 0fbbc3605adf92c38b0bf4a36b5d7abeca7a585a
SHA512 449d0737f09a21e03ac7e6732c75a69b22da41afe164f497063da83e1865d77ca7dc5fa96db519bffae32443984a9064653de92ae52d55cb0decd075feb60a6a
TLSH
T15B515D3E5AE10117E5B3DB07ADF740662B32BE966439D80D12C04B5E2CB2615E864FBF
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 512B
SHA256 74d0520e74c21c0a5f4c6ac1d9c9330be4705562b9cf60650b18d87ccfa571d7
MD5 06eb67b60d083996a608c0521907e024
SHA1 e689c1b70137382850c20b9a096bce4d78a1a660
SHA512 979cedb3a97432e59dfa2183e3604e848dca5e94946f2e0a7098bdaf4085173604d9c55e8325be6cdf0772d13b724f786d0e783cca7e6c5ee5adc21515b1a4de
TLSH
T135F0372F9DE51116D5B3EF4369F740111B76BDA62839E40D02808B8D1C72614ED30F7B
MD5 SHA1 SHA512 TLSH

Submit Download

Eupdate Helper_log.txt

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper_log.txt
Size 2KB
SHA256 4f05f3e2724cf0312b7df0dff01250b740fa5dcd9ad41f8d5f7720bc1c0a98cc
MD5 76fce41c2a1342ae1fabf5725c1b828f
SHA1 0781fe8c6e52dca1f4e3ea0285b370f19a5a4b0b
SHA512 016c0c5bd37bb53f5f414163e8cc4546aeda2cab27b286c9ae2136298018a3d1c92ee4d5030532022c526fd55bc4143fca4bc761dc0faa44040eb5a53d59bf43
TLSH
T16D516C3E5AE10117F5B3DB0BA9F740662B36BE956439D80D12C04B5E2CB2614E864FBF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3196-50-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4112-26-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4652-27-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4652-41-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5140-10-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5640-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5640-4-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5780-19-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5928-51-0x0000000000400000-0x000000000042C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads