c798ae31c1a60b58672f9e4593a82f8ff2f924f2d8da9996a7bc4bf8ab9e863f

Analysis

user interaction
yes
max time kernel
6s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emu_inner.exe
Size 374KB
Sample260910-2e6b3ahm9w
SHA256 c798ae31c1a60b58672f9e4593a82f8ff2f924f2d8da9996a7bc4bf8ab9e863f
MD5 ddc2a39608182c1963d28abbf74d1c58
SHA1 5858547f60e1eedd7844304dbd7b3b91ef7f70a5
SHA512 b6c7ec4319b7bb3e94133aead6a42b5257f03c491c8df7e2eff7a0f076ff7e0af47d5549307b6ddae193f5beccdce61c0979970202df5e668ce89794c7fa9737
SSDEEP 6144:zQa3+zbrMxW+I2ekqCe61WQCPOKISlBa58zZXbNxzvtCloWni8tTKxXofEF4I37j:zQBzbEde3POKIiEi9DWnjkBoA7HdR+X2
TLSH
T1BD847E2AEA5404B8E177D178CE578803F772B88D0375ABE757D49AA21F175E0EE3E600
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	emu_inner.exe
File opened for modification	C:\Windows\System32\drivers\etc\lmhosts.sam	emu_inner.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks	emu_inner.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol	emu_inner.exe
File opened for modification	C:\Windows\System32\drivers\etc\services	emu_inner.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5180	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5148	emu_inner.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 5180	5148	emu_inner.exe	82

C:\Users\Admin\AppData\Local\Temp\emu_inner.exe
"C:\Users\Admin\AppData\Local\Temp\emu_inner.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title EMULATOR
  2⤵
  - Executes a command shell one-liner
  PID:5180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads