86d784b4567de6a4805c5a7db53357e45b79f65f2373e81f07c8611d45b9079e

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86d784b4567de6a4805c5a7db53357e45b79f65f2373e81f07c8611d45b9079e.exe
Size 259KB
Sample261014-e7dq7aee28
SHA256 86d784b4567de6a4805c5a7db53357e45b79f65f2373e81f07c8611d45b9079e
MD5 6af735882d2e374217c4f427bf8078e6
SHA1 7b0ce5a8123ac32ed16f61953d4d1026cbacc215
SHA512 cddc2243543253f196bc4cc7e4f5890616e6829ac0424d4925737730c79e0f5dd4a98669061fb3ae4e35bb240575547dd994acf195ebe66ea801d0e82dd3cfaa
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeD:FnWHTc5n1oS8CQxeD
TLSH
T11D440A1BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3448	Eupdate Helper.exe
1236	Eupdate Helper.exe
3464	Eupdate Helper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1236	Eupdate Helper.exe
1236	Eupdate Helper.exe
1236	Eupdate Helper.exe
1236	Eupdate Helper.exe
1236	Eupdate Helper.exe
1236	Eupdate Helper.exe
1236	Eupdate Helper.exe
1236	Eupdate Helper.exe
1236	Eupdate Helper.exe
1236	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3448	4028	86d784b4567de6a4805c5a7db53357e45b79f65f2373e81f07c8611d45b9079e.exe	90

C:\Users\Admin\AppData\Local\Temp\86d784b4567de6a4805c5a7db53357e45b79f65f2373e81f07c8611d45b9079e.exe
"C:\Users\Admin\AppData\Local\Temp\86d784b4567de6a4805c5a7db53357e45b79f65f2373e81f07c8611d45b9079e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\86d784b4567de6a4805c5a7db53357e45b79f65f2373e81f07c8611d45b9079e.exe"
  2⤵
  - Executes dropped EXE
  PID:3448

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1236

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 86d784b4567de6a4805c5a7db53357e45b79f65f2373e81f07c8611d45b9079e
MD5 6af735882d2e374217c4f427bf8078e6
SHA1 7b0ce5a8123ac32ed16f61953d4d1026cbacc215
SHA512 cddc2243543253f196bc4cc7e4f5890616e6829ac0424d4925737730c79e0f5dd4a98669061fb3ae4e35bb240575547dd994acf195ebe66ea801d0e82dd3cfaa
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeD:FnWHTc5n1oS8CQxeD
TLSH
T11D440A1BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 21f368a15b1f017d09f04b47ef53504ede44b00f2a7c99efd3aecca8a069e38c
MD5 d329a32d299819fcaa3969e54ec8932f
SHA1 1c9f636081435fac231999327d87cb7cf3884b29
SHA512 f3ba94002da33ce3984528bb43f16044432c56a32f08a3880f5d6e0620e05a6efdbc240853a9a9dcf8da0f497526c5f280218eb91f02aa82bcb52ae6b8a2d258
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeE:FnWHTc5n1oS8CQxeE
TLSH
T167440A1BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 efac04cc5d4a15d8887b0a0564bfdc778861fec70def5b215a93870bfff1f78f
MD5 d761125dc6e6b84482ac16cf80acaac2
SHA1 d8fec2aa2674b6e0a83bc3683e32f3b3ab7e2d3f
SHA512 7dd6ddf4ea70edeec0726f6d052ee217f89672af111cf0a61b18a461d9ea5ec33f7ae709720badbf73126f406893a1d09028a92adf0fd6144ade511c81fdfca2
TLSH
T18B51D1356AE91057EBF2D917DCF7540BE9B978923935DC0E028147CC2C6260599E3F4D
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 866B
SHA256 3c347732d96662fa7c4f2cfd501db834aacf8959c94b4ecb9cdd3956dbb932c2
MD5 3a0c52f81015f7c9b5c22cf348a2d107
SHA1 63c32469fd4bcff33670e59839433beeb5bc800b
SHA512 5106a6bbda5dad3b9a37f3350090872c521479b4e17a79d47da7b9e8070b09c79b8f77312625f7a659c6b14dcc4469ba1449278ad74a8ea9f5a58a3d494fb8bf
TLSH
T129119E3969EA1167DBF2C913CCEB141BE97879926935DC0D068287CC2C62611A8E3F4E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 d370b9fa9475d686a1f7994a69bf14010e29a96c211d21cf130e95483af7ef09
MD5 c8e2bec69a0006a29049a969ff0d727f
SHA1 60c03c2840e67efe8b8fed1314992e301813b57c
SHA512 85a66213901f28f6d41efc640c7262988c558fac50cbcf9050afc5e63cd30495a2432fb83c620d3aacc5d16d07e945832fc455bd6b0a271d1a5c051cbbcee6cc
TLSH
T10C41D1396AE91057EBF2D913DCFB140BE9B978523934DC0E068243CC2C6260199E3F4E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 2KB
SHA256 f4342e6af3a8e6ac69e016bbe456f88b8a65bf9737209d56340d1acd87912bd6
MD5 96d4945f3f43ae16a81611b790bec0a9
SHA1 ae55989c0ec2b5ce91e858bd66796c67d6536e61
SHA512 b16952a3f9beab9955435559e23af76b4d16d8a1a1bd2e29dff8b91ecdcb2843fdd71843a850ccb552fd8dfde6d553273961aaaad0f7b4fb50f5b8c6778598ee
TLSH
T11851792A13AA0206F6B7DB07C8F7980B797979537975DD0E228147CC2C75204A6E3F5E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 3KB
SHA256 ef6375e0f99a741c264bb592de896b457393af5ac795f15640e1cd86be9c4b02
MD5 6f2ed05bb8c228d293206acf8579ffa9
SHA1 627a9f7b725a54cc220fe706284aa8857bb95050
SHA512 030c101308fa901e523618d5736916e6ee7695b631a3845987099a909b7f8c248055b1f8f768ed2543867834b8cd889042c3353d67e6339cffd9bb287a2dc8a0
TLSH
T157718B2A53AA0206F6B3DA07C8F7980BB97979437935DD0E22C187CD2C75105A6E3F5E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 2KB
SHA256 a21b7cacce4faa7bc117f16dfc94b0c838e3c31ce87e49e54f97690f6efd6724
MD5 343921d4ad0403fd3979a81015fb88f8
SHA1 0e6b1143a8550b9409e7d2bf029e6f60dafa21ef
SHA512 0faa5c07c803a0f691ae5184478fa9475ff8b1389433183570de3b4e8558a5a7c4cdb3cbd90df591199145305d363fac55505d49736c9cc89deda2988e956bf0
TLSH
T1AD51892A13AA0206F6B7EA07C8F7980B787938537975DD0E228147CC2C75204A6E3F5E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 2577de47a19f0d3d4e520578ccbc628bc3b6a83d4ca3c232a5db8838df29ff99
MD5 ecd1bf999cc175782c7c038245f8f6da
SHA1 0b20bed434234b42fb1cf739a6bb1f30e7e4ee1b
SHA512 cac72f1b401f2dce27a311c53759c6d38b68c8b7ea3eb1a814e80a80bdead7f91550d5f0ada8f1b4aa46953496e588eb54ee860cfd1be0232cd6b2f898e937a0
SSDEEP 48:hXjWs4XjW+0+1XjWFYnHBXjWJLzcWSMWnU4b0T1OYnHB6Lj3W93WeM2BlWrYrlWm:DUcPJMQXwTEHNb31PqKHVAgtwQaM
TLSH
T1B8A1A02A13E50216E6B3EA07C8F7980BB97939437935DD0E62C187CC2C79105A6E2F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download