cc75cf25f781af641bb98a846eda4d41dd241efbeed3126e896ad52edf1bc66b

Analysis

user interaction
yes
max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 21:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EMULATOR13_cracked3.exe
Size 63.5MB
Sample260724-z7q2qstdkb
SHA256 cc75cf25f781af641bb98a846eda4d41dd241efbeed3126e896ad52edf1bc66b
MD5 b40ff74042ef7969f15433d234cb25ef
SHA1 2ad7d36f6847ac23a1fa4131935d7198f9deaba0
SHA512 c2404aa1092767357f814f92ff8899320df290eae95959bd6475963028766b1ae55c05699aaec3d4b3bb55c3a6355e289661c75bbd97f62170b4db38ef6e6695
SSDEEP 786432:xKxjiiiSVAbjr6CyriYkFNujirVYi3KYm+wHD:xKxjiiiSVAbjr6CyOYANujiRYiQHD
TLSH
T144E7724C24500AE5925BE815EAABCF1B5FE9D6DB5BE8244DBCA88E340CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
5	pastebin.com

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2600	sc.exe
1192	sc.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3900	cmd.exe
3116	cmd.exe
2400	cmd.exe
4176	cmd.exe
5956	cmd.exe
3440	cmd.exe
3700	cmd.exe
4916	cmd.exe
2880	cmd.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2616	taskkill.exe
2124	taskkill.exe
2516	taskkill.exe
4300	taskkill.exe
3496	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe
912	EMULATOR13_cracked3.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	EMULATOR13_cracked3.exe
Token: SeDebugPrivilege	2616	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	3496	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 3900	912	EMULATOR13_cracked3.exe	89
PID 912 wrote to memory of 3440	912	EMULATOR13_cracked3.exe	90
PID 912 wrote to memory of 3116	912	EMULATOR13_cracked3.exe	91
PID 3116 wrote to memory of 2616	3116	cmd.exe	92
PID 912 wrote to memory of 2400	912	EMULATOR13_cracked3.exe	94
PID 2400 wrote to memory of 2600	2400	cmd.exe	95
PID 912 wrote to memory of 3700	912	EMULATOR13_cracked3.exe	96
PID 3700 wrote to memory of 2124	3700	cmd.exe	97
PID 912 wrote to memory of 4176	912	EMULATOR13_cracked3.exe	98
PID 4176 wrote to memory of 1192	4176	cmd.exe	99
PID 912 wrote to memory of 4916	912	EMULATOR13_cracked3.exe	100
PID 4916 wrote to memory of 2516	4916	cmd.exe	101
PID 912 wrote to memory of 2880	912	EMULATOR13_cracked3.exe	102
PID 2880 wrote to memory of 4300	2880	cmd.exe	103
PID 912 wrote to memory of 5956	912	EMULATOR13_cracked3.exe	104
PID 5956 wrote to memory of 3496	5956	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\EMULATOR13_cracked3.exe
"C:\Users\Admin\AppData\Local\Temp\EMULATOR13_cracked3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:1192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im vgm.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vgm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3496