0eba73962a74b914a11d050ff449e1d9ec93e2ff6071f1bc568e7c85fadbc625

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0eba73962a74b914a11d050ff449e1d9ec93e2ff6071f1bc568e7c85fadbc625.exe
Size 259KB
Sample261017-e16hmawyfw
SHA256 0eba73962a74b914a11d050ff449e1d9ec93e2ff6071f1bc568e7c85fadbc625
MD5 ba1f47462911b3260aa283e8abc4eb95
SHA1 d565c19404f32104f44bbe28bec038bf714b2734
SHA512 ad7cb8a46e0b25d215293fa2885ece2f6966688cc7d720172a54b1c9997afb0ae5896b3899c91426331864a46db8f3be1d658d0596724fbc3bf2b9d35ba88514
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeC:FnWHTc5n1oS8CQxeC
TLSH
T116440A1BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4168	Eupdate Helper.exe
4352	Eupdate Helper.exe
3100	Eupdate Helper.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4352	Eupdate Helper.exe
4352	Eupdate Helper.exe
4352	Eupdate Helper.exe
4352	Eupdate Helper.exe
4352	Eupdate Helper.exe
4352	Eupdate Helper.exe
4352	Eupdate Helper.exe
4352	Eupdate Helper.exe
4352	Eupdate Helper.exe
4352	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4168	3236	0eba73962a74b914a11d050ff449e1d9ec93e2ff6071f1bc568e7c85fadbc625.exe	90

C:\Users\Admin\AppData\Local\Temp\0eba73962a74b914a11d050ff449e1d9ec93e2ff6071f1bc568e7c85fadbc625.exe
"C:\Users\Admin\AppData\Local\Temp\0eba73962a74b914a11d050ff449e1d9ec93e2ff6071f1bc568e7c85fadbc625.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\0eba73962a74b914a11d050ff449e1d9ec93e2ff6071f1bc568e7c85fadbc625.exe"
  2⤵
  - Executes dropped EXE
  PID:4168

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4352

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 0eba73962a74b914a11d050ff449e1d9ec93e2ff6071f1bc568e7c85fadbc625
MD5 ba1f47462911b3260aa283e8abc4eb95
SHA1 d565c19404f32104f44bbe28bec038bf714b2734
SHA512 ad7cb8a46e0b25d215293fa2885ece2f6966688cc7d720172a54b1c9997afb0ae5896b3899c91426331864a46db8f3be1d658d0596724fbc3bf2b9d35ba88514
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoeC:FnWHTc5n1oS8CQxeC
TLSH
T116440A1BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 259KB
SHA256 1fcae57cf608fc9898d313bb6cb5b4591595b715894ca3a581d978988cd76021
MD5 43b0bcd653a3daf444f9ce3682d8ff41
SHA1 2dd72e240ee20c68dfbb0bfc17715d044de5fe9c
SHA512 d04be8d86886482c5e8314e638b201cc121ea32198ff859ff590217a3f78ecfca1989092341b3141daa8a4347cf37706886ed688b1ebbcdcd7b768543c395cb7
SSDEEP 6144:FNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBoes:FnWHTc5n1oS8CQxes
TLSH
T1F1440A1BB3E309BCD66B823986A6D3729931F4140335FA1F1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 866B
SHA256 e509c66ef9e90519badf8018dbf5e78e5570090e3728157e8cb9f0a5161d490b
MD5 2b719043d9ce6131f90728c4292a0d87
SHA1 d5a21566be539e7a7fc7fe15ffee0bf817649f15
SHA512 6a09a8351f8c3e737e5daa4c80da752793b06a8e09847c40d88456111482d568669ce743038d8c29fc8b911483d9565d871b2757c370208c088834abaee18feb
TLSH
T18B11CC3E19D80221DBB7DA53D4F6500BF874B862B8359C0D0AC213CC1C64610B9E3F4E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 047192da6b079eb96e01a2f06a94f237793e7ff5d89cdf0b68f086cb053f4e7d
MD5 e2034afdb8150018cba4cc4846ef4a73
SHA1 706df71c30239d7d39b7d50c265d5f4ff8127bd7
SHA512 87a323b3094dcfcb16a30aa665244c07f8b76f6503f1d06656f768b063c60097891b36fb79129751bb62abbbd770ef95f6ede0bfe1292fad954f87e65dff1af3
TLSH
T11541A43F1AE80265EBB7DA57D8F7541BF975B9227835980D06C207C82C61610B9E3F8E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 2KB
SHA256 44f74237e87eb8a145b14dba18418e7799f106f2157f337480fc667d3850c6e7
MD5 1cc39e63ff97ef5a370921b88bbae9a7
SHA1 4c508630e22086637356d83a47067fc800d10725
SHA512 68ef711851993dbc7b15a6c49899cb354c9f537418cf5de8b6aa8a05bc9284c16608569c3e5fcda27567716d0c205b0b9a3bef1c16cdd5c1a03f042c1dc9bd57
TLSH
T11151BD2F17A84525F7B7CA03C8F7941BA935B952AA39CD4D06C203C91C72500B6E3FAE
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 3KB
SHA256 e42f0dcfbe8d64a04352fc1197b83c89ba918beea946dd36a5d3c06e4ae6d0c7
MD5 390843769130f50142d96a62c006dd5d
SHA1 a38a7aaa3c0865fdda43e1db483b6fde95f20794
SHA512 8aca76b12f15fdb0534254f7898df00a9e84f901169a144dff6cf3bc9f061e0ea07760c9204f314942bfb452bb0b2a152712c1a92d9e03aa99e242f395bdd6bb
TLSH
T10B61AE2E17A44525F7B6CA03D8F7941BA935B952AA39CD4D06C243CD1C72500B6E3FAE
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 2KB
SHA256 8f53dcbd16d2a13455df1a97b51f212f7991bab91482a7a8d42b1c9ccf814dd2
MD5 15954c32a2ce75338304e5bdc30ff3ce
SHA1 21d528f7b4d0a89dc3eb52119e12d1333c30113d
SHA512 e802d3b8616aebbf0b0c602cfd3d85fd11fc67bf4e7d0eb3b505abfb35098b23d0443f3da7e7e4f76e589b1d854be7a3b4a50c5e4a10b461dea34a2451d06239
TLSH
T14551AE2E17E84521F7B7CA03C8F7941BA935B952AA79CD4D06C207C91C72500B6E3FAE
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 e96012997ababbbefd0c49480dd291e97a8c20842e4bca913bb3bf120fb2a700
MD5 e60021468e765038a1811a53cb371511
SHA1 3d1b4c51251ea6bdafcc9cfb1bf4e41218b50f26
SHA512 3874f1fc99b7a1eac349dd341745e00860cfd7c56ddc4ca50bf1f0793281f1145cb5b712820e3e3721cacd81a3a7593b57903981e60c78f13a501dc0463ad864
SSDEEP 96:uYqTYPZYwuYCY+EY4KFYOYPM/YToYZwDYkTYoYxuYbY41YKJpsxNbOJ9uYJ9uPqn:XdrKdPPufkM
TLSH
T192A1CF2E17E44521E7B6CA07D8F7901BAA34B953A939CD4D02C247C92CB2501B6E3F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4168-42-0x0000000140000000-0x000000014004A000-memory.dmp

Download