dc89d4001a263cd634185aa6814ac9bb82b212466771fecf3fb8d3f750274833

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc89d4001a263cd634185aa6814ac9bb82b212466771fecf3fb8d3f750274833.exe
Size 254KB
Sample261017-d5h3fswthy
SHA256 dc89d4001a263cd634185aa6814ac9bb82b212466771fecf3fb8d3f750274833
MD5 f0ac574b792362c60871d02dac969b2a
SHA1 d34bf3f009dfc429b979c433ac181a1d6f9c98c6
SHA512 68ebdaf3d42a940b35885bea06e7bfb936b7153e4c3728f6a1632564880ace2f1d10650409f30d494090350ec401e041fe0a1ab2065da5a51bbfeb655d2ba79e
SSDEEP 6144:gj72EsQv9DiquoXgrn4HmvmDPTWLUxv3YhL:g+ho24HmvmrLYhL
TLSH
T1C244091BB3E30CFDD66B813586A7D3329932F8250335FA1E1694CB333D61D605B6AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	4276	Eupdate Helper.exe

Executes dropped EXE 3 IoCs

pid	Process
2928	Eupdate Helper.exe
4276	Eupdate Helper.exe
2360	Eupdate Helper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4276	Eupdate Helper.exe
4276	Eupdate Helper.exe
4276	Eupdate Helper.exe
4276	Eupdate Helper.exe
4276	Eupdate Helper.exe
4276	Eupdate Helper.exe
4276	Eupdate Helper.exe
4276	Eupdate Helper.exe
4276	Eupdate Helper.exe
4276	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 2928	3756	dc89d4001a263cd634185aa6814ac9bb82b212466771fecf3fb8d3f750274833.exe	85

C:\Users\Admin\AppData\Local\Temp\dc89d4001a263cd634185aa6814ac9bb82b212466771fecf3fb8d3f750274833.exe
"C:\Users\Admin\AppData\Local\Temp\dc89d4001a263cd634185aa6814ac9bb82b212466771fecf3fb8d3f750274833.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\dc89d4001a263cd634185aa6814ac9bb82b212466771fecf3fb8d3f750274833.exe"
  2⤵
  - Executes dropped EXE
  PID:2928

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 254KB
SHA256 381fd68cfb7f87a7afa8e5b837fb75d0f8215f3c355e2a470830bde40412ad1a
MD5 88f54c5650df8dc55c1c02f6aab749f6
SHA1 832a5fb0c5a9d75a334b383808e82f2615931cf1
SHA512 a6f639f21f17a1962c91a28deea1c5576a5d1f4ce8170c878289b633fde90631b4c5c23f26416dc646b72cce096b3ecb7b6b9b910beb955865bde54addcaff3e
SSDEEP 6144:gj72EsQv9DiquoXgrn4HmvmDPTWLUxv3Yh9:g+ho24HmvmrLYh9
TLSH
T1E644091BB3E30CFDD66B813586A7D3329932F8250335FA1E1694CB333D61D605B6AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 254KB
SHA256 dc89d4001a263cd634185aa6814ac9bb82b212466771fecf3fb8d3f750274833
MD5 f0ac574b792362c60871d02dac969b2a
SHA1 d34bf3f009dfc429b979c433ac181a1d6f9c98c6
SHA512 68ebdaf3d42a940b35885bea06e7bfb936b7153e4c3728f6a1632564880ace2f1d10650409f30d494090350ec401e041fe0a1ab2065da5a51bbfeb655d2ba79e
SSDEEP 6144:gj72EsQv9DiquoXgrn4HmvmDPTWLUxv3YhL:g+ho24HmvmrLYhL
TLSH
T1C244091BB3E30CFDD66B813586A7D3329932F8250335FA1E1694CB333D61D605B6AA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 6930e35a89e8f7b36bb2baed5fc2c8088a4259effe67a7356238fa8d774d6b9c
MD5 4598eb1fb1ddc77026b9a713cefdd4d8
SHA1 d550c863ed5d5439acadcee93923d6646791bf45
SHA512 bd4382d15bd390385301279b56e3178320b59aa5495c1c09c952a568d4f6e8cc7530e6d2af211473f6fdc89285bf6c0e36348a6613fa4f3d825fc365bae79804
TLSH
T19F519E3E5AD80169EBB7DA03D4FB440BB879B9A369798C0D06C117C81C61604B9E3F5D
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 c70c97ac5d3ac35e2e0f5cc054ff55ec40aec49eb72b6181b94d3a7c1bd71a1a
MD5 4fcf6639cd4bcf90101d270d3600bbac
SHA1 31fef7c04d0013b2d4a8858ad0e1e7d065399eae
SHA512 43c5f45f5ed34bce65d369031acb0c894cad82a23bf0b817054b1a343f31d7e0c0093b56efbf20917a8a77fdd002154af4e4f5d094913f2276269b1d05fdb7b4
TLSH
T16A41A03E5AA80169EBB7CA07D4FB040BB875B9A379398D0D06C117C81CB1601B9E3F5E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 4KB
SHA256 6cfa3502fe7d36edb0873f1ab83a78ac0e968bc327998ea57594ef9f28c3db18
MD5 42c8f9792806b12304125c2bc0cb2e55
SHA1 13158617b5a152c29f2feb2d3a2f15718517628d
SHA512 59aaa0135613d4fb561bf4b080b486567943d45d747ccfb6a57d26dbd48888a84f84152918b1d46c6fafefbccc23163bcf246154035b9f5171f61b1099e20e72
SSDEEP 96:lFZMFFFllFIDC8X5v5UMA5Sv5Xy15aAlGsM5plMA7sGj6Kj6LYDjj3bu:jY9LCDu
TLSH
T1CA81AD2F23E8021AF7B2DA03D8FB840BB97579536979C90D12C107C91C75541AAE3F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 3KB
SHA256 ff0e6e265f743c26be7194a87478e682f0d973874de93c9d399e0ce540d7904b
MD5 90386d9f9805e3a5a2d58220c835c1cf
SHA1 d40724f64e37c468189c9c3a4ba047ae510de739
SHA512 0fe6c15373f3024aef23c4b6e9812b529d44e80dd9b2d4c9eaea3a6cddb8330c5d6a717c89dfd02d3100614e8fdb16b25640f218b069c25361b1fc1de8c60189
TLSH
T1F3717D2B23E9061AF7B2DA03D8F7840BB975B9636979CD0D12C147C91C75500AAE3F6E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 0f603758b6c2c2205e06a43dab8b4b0b471ba989e643e9bbbbf06c5f5b1ba87d
MD5 5bca1d4301b7aeba1269862439a38155
SHA1 39b3ba667424c2fc3e1d4b60a29a35c4f927b09a
SHA512 69d9ebfa802a583aa199003a99e6ba2e70008f5c51fd48d38e858f72c092a9f61f8558461296a2163321fc1a2ecf820388c6cec4e82ba10ea4a6ffebf03a342a
SSDEEP 96:lFZMFFFllFIDC8X5v5UMA5Sv5Xy15aAlGsM5plMA7sGj6Kj6LYDjj3bou2:jY9LCDK
TLSH
T1A6919D2F13E8021AF7B2EA03D8FB840BB975B9536979C90D12C147C91C75541AAE3F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2360-65-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/2928-45-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/3756-8-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/4276-64-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/4276-77-0x0000000140000000-0x0000000140048000-memory.dmp

Download