a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8

Analysis

user interaction
yes
max time kernel
34s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 08:56

Target
bokluemulardan.exe
Size 248KB
Sample260810-kv1cbaveqa
SHA256 a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8
MD5 db0272f22913973dd0e10a4ce7682580
SHA1 c5c5819c4996a291042bdd819c16fcf0cb505856
SHA512 c8bda14715b9081122104a6824ff31053bc68bcb37531339753f6b21f0cadcd5b5abf1d83864d53ee7f156932945b415ae807a645188e60c8cd29517f4b121e8
SSDEEP 6144:NDgfruqoTsl/t/8ATCH1rplg8H6Oq4g+fF:Njhgl/t09HrlZVqluF
TLSH
T175447C3DBA280CBDDA6EC079EE83C906DF327C474365D6D713905AA20E176E59E3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4636	4232	bokluemulardan.exe	86
PID 4636 wrote to memory of 616	4636	cmd.exe	87
PID 4232 wrote to memory of 2964	4232	bokluemulardan.exe	88
PID 2964 wrote to memory of 4468	2964	cmd.exe	89
PID 4232 wrote to memory of 3456	4232	bokluemulardan.exe	92
PID 3456 wrote to memory of 3772	3456	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\bokluemulardan.exe
"C:\Users\Admin\AppData\Local\Temp\bokluemulardan.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:3772