a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/07/2026, 22:30

Target
Emu.exe
Size 157KB
Sample260731-2eybfshe99
SHA256 a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937
MD5 d6b39483c34a8894a8467b01a2997093
SHA1 7c4492b1ae8baa9499acd692687dbd390d85e915
SHA512 ba9179d0c545abd79f6747c6d15fefdac4c4104d2e500754ad9cd641f99b0a5ed5e4a6b59d5e3423c2d07866374d4055da942e44a41c5a229c8c9f27439f9fb8
SSDEEP 3072:rgFnhEeACHpm08WTU+4hCjET+Y90ffI12bLccqIFO+OGHgIOnmE+QR0nzJ80:rgFSeACHpm08WTUhhCQrD2Oh+QR0nzJ5
TLSH
T164F34C37A925107DD26BD578DA575903FF32788703A1A6CB17805EF20E176E8AF3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4632	2796	Emu.exe	82
PID 4632 wrote to memory of 2740	4632	cmd.exe	83
PID 2796 wrote to memory of 1248	2796	Emu.exe	84
PID 1248 wrote to memory of 468	1248	cmd.exe	85
PID 2796 wrote to memory of 3600	2796	Emu.exe	86
PID 3600 wrote to memory of 4148	3600	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\Emu.exe
"C:\Users\Admin\AppData\Local\Temp\Emu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:4148