a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937

Analysis

user interaction
yes
max time kernel
298s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 20:30

Target
Emu.exe
Size 157KB
Sample260802-zaangsfd29
SHA256 a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937
MD5 d6b39483c34a8894a8467b01a2997093
SHA1 7c4492b1ae8baa9499acd692687dbd390d85e915
SHA512 ba9179d0c545abd79f6747c6d15fefdac4c4104d2e500754ad9cd641f99b0a5ed5e4a6b59d5e3423c2d07866374d4055da942e44a41c5a229c8c9f27439f9fb8
SSDEEP 3072:rgFnhEeACHpm08WTU+4hCjET+Y90ffI12bLccqIFO+OGHgIOnmE+QR0nzJ80:rgFSeACHpm08WTUhhCQrD2Oh+QR0nzJ5
TLSH
T164F34C37A925107DD26BD578DA575903FF32788703A1A6CB17805EF20E176E8AF3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 3680	3800	Emu.exe	87
PID 3680 wrote to memory of 1928	3680	cmd.exe	88
PID 3800 wrote to memory of 4844	3800	Emu.exe	89
PID 4844 wrote to memory of 4192	4844	cmd.exe	90
PID 3800 wrote to memory of 2336	3800	Emu.exe	91
PID 2336 wrote to memory of 4492	2336	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\Emu.exe
"C:\Users\Admin\AppData\Local\Temp\Emu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:4492