8c1a4568a101766f9e94144a2c1dd9b774666c39c64c18ca818b575ce9f519c5

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c1a4568a101766f9e94144a2c1dd9b774666c39c64c18ca818b575ce9f519c5.exe
Size 259KB
Sample261014-2te4estwcy
SHA256 8c1a4568a101766f9e94144a2c1dd9b774666c39c64c18ca818b575ce9f519c5
MD5 3f5008bf2b40cf8665398b268c5a0ab2
SHA1 bbec28a4f8488e60923a9824cae4a88238163d10
SHA512 e0420e8fa8207db9de77482fee4f6b79127d9c90f823c817eb33ef847df9b491e18ce172e2a59270cf8e81781e5b02ac6710603ddfbc5e2d08bdb053874db65b
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeJ:FnWHTc5n1oS8CQxeJ
TLSH
T19144091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4456	Eupdate Helper.exe
3948	Eupdate Helper.exe
5904	Eupdate Helper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3948	Eupdate Helper.exe
3948	Eupdate Helper.exe
3948	Eupdate Helper.exe
3948	Eupdate Helper.exe
3948	Eupdate Helper.exe
3948	Eupdate Helper.exe
3948	Eupdate Helper.exe
3948	Eupdate Helper.exe
3948	Eupdate Helper.exe
3948	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4456	3944	8c1a4568a101766f9e94144a2c1dd9b774666c39c64c18ca818b575ce9f519c5.exe	89

C:\Users\Admin\AppData\Local\Temp\8c1a4568a101766f9e94144a2c1dd9b774666c39c64c18ca818b575ce9f519c5.exe
"C:\Users\Admin\AppData\Local\Temp\8c1a4568a101766f9e94144a2c1dd9b774666c39c64c18ca818b575ce9f519c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\8c1a4568a101766f9e94144a2c1dd9b774666c39c64c18ca818b575ce9f519c5.exe"
  2⤵
  - Executes dropped EXE
  PID:4456

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3948

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 a895e2222c6a73f54a419935fb242c79681813e40a94470a540e43aa4ab3bffc
MD5 4d23ba9981242cbd65eb139dcc1bb075
SHA1 c2443d7e06f627328e820349f98f6ed15a625836
SHA512 79a5a364d72f797c6f74b27edfa17db863e74ffbc8235ce9590cef33dad5e1a995ed48496c352c15df506db4970f5f0fedb0758d8e12f6ef08b4097b257d7cd9
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeI:FnWHTc5n1oS8CQxeI
TLSH
T14B44091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 8c1a4568a101766f9e94144a2c1dd9b774666c39c64c18ca818b575ce9f519c5
MD5 3f5008bf2b40cf8665398b268c5a0ab2
SHA1 bbec28a4f8488e60923a9824cae4a88238163d10
SHA512 e0420e8fa8207db9de77482fee4f6b79127d9c90f823c817eb33ef847df9b491e18ce172e2a59270cf8e81781e5b02ac6710603ddfbc5e2d08bdb053874db65b
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeJ:FnWHTc5n1oS8CQxeJ
TLSH
T19144091BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 0b86f1612a5b87fa11e205be8995dd7f4fb0bcba65f998ea68693353f42eb845
MD5 55d9b3b496ea34655481fa1ce736a1fd
SHA1 fe32ad7ae280da8a75067010a9dfe70d8ab14646
SHA512 f2cf086028a9f16d77cdc57f7809d841471a744d305875666ff7c9c0c7e79d7dd6aa15c499f3295b6c4d0608b962df1b9e41fcffc6fcd663238b505c7e4ff59f
TLSH
T11441D41D56D801A6E7B7CB47D8BB400BBDB6B8527931E90C16C20BCC1C61A05B9E3B8D
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 866B
SHA256 bbc5d78534326f96801e1217bb5bd31b7befa20f28cb78d3b2f3b06b9304432c
MD5 d8e63130ef5d1b58c89c3584e021a066
SHA1 6216a23be30805919c356c2f19ea17111a372f8d
SHA512 39f6156e616cf1868d2892867e2b8da6fffaa0cf1f437d248053d307f7efe9a33a69b44c8f91c0e13d8b020d787dabe9ad3aa8e5d1458a8459de50a931c73a85
TLSH
T14C11921C99E810A7E7B7CB5BD4BB100FF9B574526831A90D16C20BCC1C62A16B9D3B8D
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 3KB
SHA256 2aa8c956a324048f9604076f74502f70332c7edf69aa8f0730f37a0c45257c63
MD5 3e0a7dcfb0d4268d72a28948904945c8
SHA1 d25a287c383fa30114d1be371a478b5f68bb1c66
SHA512 97b07783332e9b19990b035d3f17926c6b90c83f20d4a0b9512efc4788c502f3a0f179c3e335c15b84110728aea3c9bc35c3966dcddee80f8e382429836e868b
TLSH
T1C771AF2D5BE40292F6B7CB07C4F7800A6AB579466935DE4C12C20BCD2C72506B6E3F9E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 780B
SHA256 f2839ca5bd95a3136fdda1f4ddc52fed0031d3506a570c6e32b0818c2fa677d9
MD5 7ff32686a2e7a8f113876dbd16988672
SHA1 b248d28930704f83e3a3072d2320f186920bfa64
SHA512 1102eabe58035fffd77f1d4786de677cc9167e19a9895810fa73794fe52e4255951c5c6fda2e74b6a75f527dd2fb7e45d0e05f7e830e0db0aa104bdfeef90593
TLSH
T13701A22E5BF401A1E2B7DB07C8F6940A69B578566934DE4D02C10BCD2CB2506F2E3F8B
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 2KB
SHA256 a992525db320f6272e9f63fa87706168ff1eda742e6280535565452390e24049
MD5 af522316e13cd6b08e9448c6fdd1f471
SHA1 7e42f3e746fcc1f6cf8210a3cc294f60ca3a7076
SHA512 a2cdbd38cdfa497f8faa90bd1fe1b4c6873f3d340d655c62ac9dc45551f36b097dd751530fba1a0d63f46c87ba77f32eabf9ac753a8b3eab4986480ee1505690
TLSH
T16041F12D5BF80192F2B3DB07C8F6840A2AB538466935DD4D02C14BCD2C72406B6E2F9F
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 2KB
SHA256 555a946b570c8da483df4d84a0d1e8ac0818aba80a7f64c5bbeddc000a5f8476
MD5 b86f4b631d951c780ccf160149248ca4
SHA1 f6f1ca941fa34720c7add3f700e0fde8344085e8
SHA512 ed47a90204acec6b6327417caf3d1fa368c88b34935a7b2e861028e01b006f1bd6e3fcb70b1671de724c64e1764d18e18656cac44505484c3ac514e33bcd84cb
TLSH
T19551AF2E5BE80196F6B7DB07C4F6800B69B678466935DE4C12C10BCD2C72506B6E3F9E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 5f2ea1695ababea897512e849e1178aa9bb9e73ba1555ec514a8a0b807f3523e
MD5 7143a831ddf8c4464ddc4c6ebbf77d9d
SHA1 88091df3ddb40497b990c978bfa7e30217d89863
SHA512 36dc387b8e95ed4943add9b568c78cd885d9992d032e2612b7c280b701922fbfdae2ab54f8279800965fb190204f1049806dfd9613fe2287ed1c120bf37f8b89
SSDEEP 96:N8WwKN9j+liMyYPywmRA+WzXNIITNbtMfnPqJMyw9iRw/QALM:WG/PQdiM
TLSH
T1B2A1D12D5BE40192E6B7DB07C8F7800B6AB578466935DD0C12C24BCD2C76506B6A3F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download