633188f52c78b30517b9be41ee9d2a1cef523abee1c664b95d719c2ab5169ad0

Analysis

user interaction
yes
max time kernel
40s
max time network
39s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Private Slotted Emulator.exe
Size 63.7MB
Sample260811-s14wpafa89
SHA256 633188f52c78b30517b9be41ee9d2a1cef523abee1c664b95d719c2ab5169ad0
MD5 2559af9742d8b1677403afa5411d3449
SHA1 3120e0c71489b658db13b62a75b6fc58630b7398
SHA512 27a2b50f5abc0189d9b1c08bb25f4f1e5814800aa74b423059701ef2e34beca4e5cec3cb48491acafdff5e4a6d8d061ee6477d6ecae8a7aaf826e444232ad3de
SSDEEP 786432:tax7iqiUPAFeA7zwCvvybiJlcNjVkacqrA:tax7iqicAFe4z5vvybiJlcNhk
TLSH
T14EE7724C24500AE5915BE815EAABCF1B5FE9D6EB4BE8244DBCA88E344CD3CB71D1074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Private Slotted Emulator.exe
File opened for modification	C:\Windows\System32\drivers\etc\lmhosts.sam	Private Slotted Emulator.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks	Private Slotted Emulator.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol	Private Slotted Emulator.exe
File opened for modification	C:\Windows\System32\drivers\etc\services	Private Slotted Emulator.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5976	Private Slotted Emulator.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5976	Private Slotted Emulator.exe
5976	Private Slotted Emulator.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4548	cmd.exe
4148	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5976	Private Slotted Emulator.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 4148	5976	Private Slotted Emulator.exe	90
PID 5976 wrote to memory of 4548	5976	Private Slotted Emulator.exe	91
PID 4548 wrote to memory of 5160	4548	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\Private Slotted Emulator.exe
"C:\Users\Admin\AppData\Local\Temp\Private Slotted Emulator.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title EMULATOR
  2⤵
  - Executes a command shell one-liner
  PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con: cols=60 lines=30
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\mode.com
    mode con: cols=60 lines=30
    3⤵
    PID:5160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5976-0-0x000001CB25710000-0x000001CB25711000-memory.dmp

Download