0035e8a7fadef984188ecdaafd7d2cd413879b7c3089c48fbdfef44993f15581

Analysis

user interaction
yes
max time kernel
26s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:22

Target
Emu.exe
Size 288KB
Sample260803-ctkapsah75
SHA256 0035e8a7fadef984188ecdaafd7d2cd413879b7c3089c48fbdfef44993f15581
MD5 485e0c9979a65c33ba7a2cc009d5da41
SHA1 150cb586fcb518d7978f86c14a114e615dd8c08b
SHA512 2a02b71628ac20ebe48b395fd16de166b2755657511a2a747fa3fb2a8d5e1ba4cd757d6bd50249fce033ad8991d1fa7f46f2beee5ba794f1b82f92947939298a
SSDEEP 6144:CkgmdmEnGV2ddcb6Ol0OEX8+T/V0pnqg8uhqrgW:Touda6OKOEM6V0wYhqk
TLSH
T1F0546D3AE56410BCE16FC078EE93C907EF32784743B656E713D15AA12E276E49E3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5268 wrote to memory of 5740	5268	Emu.exe	90
PID 5740 wrote to memory of 5912	5740	cmd.exe	91
PID 5268 wrote to memory of 2300	5268	Emu.exe	92
PID 2300 wrote to memory of 1496	2300	cmd.exe	93
PID 5268 wrote to memory of 1776	5268	Emu.exe	94
PID 1776 wrote to memory of 4404	1776	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\Emu.exe
"C:\Users\Admin\AppData\Local\Temp\Emu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:4404