81b98a50bc77faedb655fa647eefeff3869b3f79a7806c73e08efb696822194c

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 07:29

Target
Emu-1.exe
Size 198KB
Sample260803-jbee3adr6z
SHA256 81b98a50bc77faedb655fa647eefeff3869b3f79a7806c73e08efb696822194c
MD5 b5509c17f25c65c50d7451bd7956951d
SHA1 f28e5bf3c37eebc2d8eafbdabe166a46168fdc35
SHA512 7c9eaab31b1045eeefb3f8ed5c117935daa87eecba74f2c11703583a3cbc93031f03006dfe3c9188d5524cba6b6a8ea822ae298014e27d7eba9dd691a2f3dba2
SSDEEP 3072:mgYXQ7HVpmU8PTXTRDeclwPsYOm9zFdIjgNBbD8SL9KReZovCNANkhteCIoTYAKT:mgYQHVpmU8PTXTVec6Hg8nrOzJ8k
TLSH
T191146C36AD2450BDD36AC079FA53DD02EF32784B4365E6DB17801AB10E176E99E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6664 wrote to memory of 4152	6664	Emu-1.exe	91
PID 4152 wrote to memory of 3180	4152	cmd.exe	92
PID 6664 wrote to memory of 836	6664	Emu-1.exe	93
PID 836 wrote to memory of 4768	836	cmd.exe	94
PID 6664 wrote to memory of 3200	6664	Emu-1.exe	95
PID 3200 wrote to memory of 5880	3200	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Emu-1.exe
"C:\Users\Admin\AppData\Local\Temp\Emu-1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:3180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:5880