a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937

Analysis

max time kernel
298s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 20:30

Target
Emu.exe
Size 157KB
Sample260802-zaangsfd29
SHA256 a9a8135be03b1a4a1c42706e4e973c09ddfc157609ab4336367131fae9d1c937
MD5 d6b39483c34a8894a8467b01a2997093
SHA1 7c4492b1ae8baa9499acd692687dbd390d85e915
SHA512 ba9179d0c545abd79f6747c6d15fefdac4c4104d2e500754ad9cd641f99b0a5ed5e4a6b59d5e3423c2d07866374d4055da942e44a41c5a229c8c9f27439f9fb8
SSDEEP 3072:rgFnhEeACHpm08WTU+4hCjET+Y90ffI12bLccqIFO+OGHgIOnmE+QR0nzJ80:rgFSeACHpm08WTUhhCQrD2Oh+QR0nzJ5
TLSH
T164F34C37A925107DD26BD578DA575903FF32788703A1A6CB17805EF20E176E8AF3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 5784	4196	Emu.exe	89
PID 5784 wrote to memory of 4860	5784	cmd.exe	90
PID 4196 wrote to memory of 4580	4196	Emu.exe	92
PID 4580 wrote to memory of 1112	4580	cmd.exe	93
PID 4196 wrote to memory of 4712	4196	Emu.exe	94
PID 4712 wrote to memory of 5564	4712	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\Emu.exe
"C:\Users\Admin\AppData\Local\Temp\Emu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:1112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:5564