a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937

Analysis

user interaction
yes
max time kernel
6s
max time network
6s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/07/2026, 22:30

Target
Emu.exe
Size 157KB
Sample260731-2eybfshe99
SHA256 a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937
MD5 d6b39483c34a8894a8467b01a2997093
SHA1 7c4492b1ae8baa9499acd692687dbd390d85e915
SHA512 ba9179d0c545abd79f6747c6d15fefdac4c4104d2e500754ad9cd641f99b0a5ed5e4a6b59d5e3423c2d07866374d4055da942e44a41c5a229c8c9f27439f9fb8
SSDEEP 3072:rgFnhEeACHpm08WTU+4hCjET+Y90ffI12bLccqIFO+OGHgIOnmE+QR0nzJ80:rgFSeACHpm08WTUhhCQrD2Oh+QR0nzJ5
TLSH
T164F34C37A925107DD26BD578DA575903FF32788703A1A6CB17805EF20E176E8AF3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3576	4580	Emu.exe	84
PID 3576 wrote to memory of 756	3576	cmd.exe	85
PID 4580 wrote to memory of 3412	4580	Emu.exe	87
PID 3412 wrote to memory of 4824	3412	cmd.exe	88
PID 4580 wrote to memory of 408	4580	Emu.exe	89
PID 408 wrote to memory of 856	408	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Emu.exe
"C:\Users\Admin\AppData\Local\Temp\Emu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:856