bb2263403b99c2d2474c3db0dae7aedb44047743fc08c63f26282fec3f7d6f9d

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 19:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb2263403b99c2d2474c3db0dae7aedb44047743fc08c63f26282fec3f7d6f9d.exe
Size 307KB
Sample261102-x6mltagb76
SHA256 bb2263403b99c2d2474c3db0dae7aedb44047743fc08c63f26282fec3f7d6f9d
MD5 1ca499583f72ccae8591de1c1e6ae0dc
SHA1 e37ff082e6688f9dce49f310b1d02c5f602aaa1d
SHA512 4768431886272c327765d6edf14647aa7542361081d37ea37996fc0b3e9970540e35abb6b398c29a91f9137c24af7209883f9ea877f3ff56b66c4db192de0fe1
SSDEEP 6144:MNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBSaN1i:MnWHTc5n1oS8CQpaN1i
TLSH
T17C641A1BB3E309FCD66B823986A6D3729931F4140335FA1E1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4108	Eupdate Helper.exe
4728	Eupdate Helper.exe
1696	Eupdate Helper.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4476-3-0x0000000140000000-0x0000000140050000-memory.dmp	upx
behavioral2/files/0x000e00000001c49e-6.dat	upx
behavioral2/memory/4476-12-0x0000000140000000-0x0000000140050000-memory.dmp	upx
behavioral2/files/0x000e00000001c4a3-26.dat	upx
behavioral2/memory/4108-43-0x0000000140000000-0x0000000140050000-memory.dmp	upx
behavioral2/memory/4728-57-0x0000000140000000-0x0000000140050000-memory.dmp	upx
behavioral2/memory/1696-58-0x0000000140000000-0x0000000140050000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Eupdate Helper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Eupdate Helper.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4728	Eupdate Helper.exe
4728	Eupdate Helper.exe
4728	Eupdate Helper.exe
4728	Eupdate Helper.exe
4728	Eupdate Helper.exe
4728	Eupdate Helper.exe
4728	Eupdate Helper.exe
4728	Eupdate Helper.exe
4728	Eupdate Helper.exe
4728	Eupdate Helper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4108	4476	bb2263403b99c2d2474c3db0dae7aedb44047743fc08c63f26282fec3f7d6f9d.exe	89

C:\Users\Admin\AppData\Local\Temp\bb2263403b99c2d2474c3db0dae7aedb44047743fc08c63f26282fec3f7d6f9d.exe
"C:\Users\Admin\AppData\Local\Temp\bb2263403b99c2d2474c3db0dae7aedb44047743fc08c63f26282fec3f7d6f9d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
  "C:\Users\Admin\AppData\Local\Temp\bb2263403b99c2d2474c3db0dae7aedb44047743fc08c63f26282fec3f7d6f9d.exe"
  2⤵
  - Executes dropped EXE
  PID:4108

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4728

C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe" --guard
1⤵
- Executes dropped EXE
PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 307KB
SHA256 bb2263403b99c2d2474c3db0dae7aedb44047743fc08c63f26282fec3f7d6f9d
MD5 1ca499583f72ccae8591de1c1e6ae0dc
SHA1 e37ff082e6688f9dce49f310b1d02c5f602aaa1d
SHA512 4768431886272c327765d6edf14647aa7542361081d37ea37996fc0b3e9970540e35abb6b398c29a91f9137c24af7209883f9ea877f3ff56b66c4db192de0fe1
SSDEEP 6144:MNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBSaN1i:MnWHTc5n1oS8CQpaN1i
TLSH
T17C641A1BB3E309FCD66B823986A6D3729931F4140335FA1E1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eupdate Helper.exe

Path C:\Users\Admin\AppData\Local\Temp\Eupdate Helper.exe
Size 307KB
SHA256 d6037a18bce070bd406001adbf2107b1c9a8c6746c8adb6905be7ace14b32e51
MD5 4834fcd86b34e3d168c4640979821872
SHA1 407faadac453fff207d673101754adb4d32f81e2
SHA512 85cc243e10c66ba07c890c542ff83dcd250fe74e8433a6c3130da361fa31c6b9273899a23fe1184915b923655040dc3449e3ffa5435a0b14a9fa6fef509bb7be
SSDEEP 6144:MNdf0ec5+p/+H6Yp65n1oS89t2QLASrHUxBSaN1g:MnWHTc5n1oS8CQpaN1g
TLSH
T176641A1BB3E309FCD66B823986A6D3729931F4140335FA1E1A94CB333D61D605F6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 2KB
SHA256 9a12907e39e04a66b3432172a7058b4e77a118413946c0b750599f6ad04b5b15
MD5 6ac3e5522500dcc5d1e690fa8d0cd0bb
SHA1 9527aeb55a65dabbdf267ae5b99e6bd344ddeedb
SHA512 b71fa824c140e2b2ed9e0791998e68caf1c555e51f361575e7751b7206881cb70eebfdd7e5211d5e497423eb93b1def9bbcba6a0dec66772629f475d608d02f1
TLSH
T15A41C63E1AE4251BFBB6C903DCFA480BB97975D22A31990D06C003C81C63605B9E3F9E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Users\Admin\AppData\Local\Temp\EupdateHelper.log
Size 866B
SHA256 ba8058ad3f7bd6e957737c952de4311b5035c191cf4d48b7499569c9ce74e9f3
MD5 377a94200eb1bc302caa5d840fcd8c46
SHA1 c44573f10a54fc47cf0b4b63261a719ae62e1e34
SHA512 1e7b476aabc7e3661c236e1a5dac90e8ed712c0120db4ee28a58ef11b9f906629d9a2b45d66d135f8d05c2f6c9ed7c7c61b536a84b4683de5ce9d140bf2323ae
TLSH
T18E11713E1AA42617EBB2C903DCEA494B79B875D27A319D0D46C403C81C67605BDE3F9E
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\TEMP\EupdateHelper.log
Size 3KB
SHA256 d9f9f9499485dabf053e640d4c2758ff136a3f6e2d7b4124107bf00e17c9af47
MD5 b3c7304897a19f7b67b07facd5214245
SHA1 b0a2ff1512a6aeeea22fd81f55a15e33f20d6e93
SHA512 49bd3decab1945fb6e151f278b40ff8b8d9255464be8bf5c40de6bcc604ee8c5b0567cb01da389644662b56f2ea98fad77e091eb3ee6198d25eacf4b473f515f
TLSH
T1D971502E1BA9061AF7B2CA03D8F6890B793939D67971C94D12D043C86C77101B5E7FAE
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 2KB
SHA256 1e5e71049d553d917543684263cc22f89af9a9f08d23813b8ee49421df4588d6
MD5 b2883944b847eee527881988d93b33f8
SHA1 49a06592632e6078a838486d25cf55c8bf1ca2d7
SHA512 e4267b18972d65fc38f505e3c1c1d789175fa70d1aa60764c8d785d399ca009ce3636ec494678974bb586f81309203ef38b01b8805286fa77380bae2bf4e0c74
TLSH
T13451812E1BA9061AF7B2DA03D8F6890B793939D67971CD4D12C043C81C77101B6E7FAA
MD5 SHA1 SHA512 TLSH

Submit Download

EupdateHelper.log

Path C:\Windows\Temp\EupdateHelper.log
Size 4KB
SHA256 e72bf96ba61690570bd7696b2762118363981678639507ac3254471a357eb3e5
MD5 01ad34b47e6a94b2779ad8f3866d7e3b
SHA1 9e4278f9bf1ad6f0592ea1e80d2f735932ee3222
SHA512 978889b4d3dd3900ccea9ae7a45907522786851fbfebcce062f0183484b5feed2ef8c5da264b4f15039428999af2c17554f8b4ccd2c209f97ddc0bed6018cf76
SSDEEP 96:VQUjOV+XEnnMobPWwEZU4OVZuewNb6YPqCekw/zM:Vzj6+XEnBbwW46ZHU6YPvyzM
TLSH
T10BA1802E1FE50626F6B2CA03D8F6890B793939C66931C94D12D047C86C77501B6E7FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-58-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4108-43-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4476-3-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4476-12-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4728-57-0x0000000140000000-0x0000000140050000-memory.dmp

Download