Analysis
- user interaction
yes - max time kernel
93s - max time network
79s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
emulator.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
emulator.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target emulator.exe
- Size 2.1MB
- Sample260930-ymrl4a1t2p
- SHA256 7c5256b1ce71ca039edcd523ed6711ea740f3e5088aabaabab43b346bffa89d3
- MD5 6036ffffd162b25957d555d5973acf49
- SHA1 2c61eddad238a8222574cb84fca10a08a4b525d6
- SHA512 7fe89d27adcb3ba988fe5acaadb225633fee8d62286ea7072a926f3cfe2e22ed768f7c48cba9dcfe7c8503b393d2a4ebc043fb0df727e16fd2b62be20cd348d0
- SSDEEP 49152:VaVW5U804KboUgm3cQncQDpvn6p8gRNbRCp5:Vbz04K8Rw
- TLSH T177A58C17E2A344FCC53BC1748296E773F970B45906347E2E2A98D7212F71EA05B9EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts emulator.exe - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 44 9.9.9.9 2980 emulator.exe Destination IP 33 208.67.222.222 2980 emulator.exe Destination IP 34 9.9.9.9 2980 emulator.exe Destination IP 38 208.67.222.222 2980 emulator.exe Destination IP 39 9.9.9.9 2980 emulator.exe Destination IP 43 208.67.222.222 2980 emulator.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
pid Process 2980 emulator.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname emulator.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain emulator.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3384 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe 2980 emulator.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2980 emulator.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 emulator.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2980 emulator.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2980 wrote to memory of 4088 2980 emulator.exe 100 PID 2980 wrote to memory of 2524 2980 emulator.exe 102 PID 2980 wrote to memory of 3820 2980 emulator.exe 104 PID 2980 wrote to memory of 2376 2980 emulator.exe 106 PID 2980 wrote to memory of 3828 2980 emulator.exe 108 PID 2980 wrote to memory of 5040 2980 emulator.exe 110 PID 2980 wrote to memory of 3284 2980 emulator.exe 112 PID 2980 wrote to memory of 1340 2980 emulator.exe 114 PID 2980 wrote to memory of 2756 2980 emulator.exe 116 PID 2980 wrote to memory of 3384 2980 emulator.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\emulator.exe"C:\Users\Admin\AppData\Local\Temp\emulator.exe"1⤵
- Drops file in Drivers directory
- Unexpected DNS network traffic destination
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SYSTEM32\route.exeroute.exe add 104.16.55.40 mask 255.255.255.255 127.0.0.1 metric 12⤵PID:4088
-
-
C:\Windows\SYSTEM32\route.exeroute.exe add 104.16.56.40 mask 255.255.255.255 127.0.0.1 metric 12⤵PID:2524
-
-
C:\Windows\SYSTEM32\route.exeroute.exe add 104.18.41.183 mask 255.255.255.255 127.0.0.1 metric 12⤵PID:3820
-
-
C:\Windows\SYSTEM32\route.exeroute.exe add 172.64.146.73 mask 255.255.255.255 127.0.0.1 metric 12⤵PID:2376
-
-
C:\Windows\SYSTEM32\route.exeroute.exe add 104.16.114.35 mask 255.255.255.255 127.0.0.1 metric 12⤵PID:3828
-
-
C:\Windows\SYSTEM32\route.exeroute.exe add 104.16.113.35 mask 255.255.255.255 127.0.0.1 metric 12⤵PID:5040
-
-
C:\Windows\SYSTEM32\route.exeroute.exe add 104.16.112.35 mask 255.255.255.255 127.0.0.1 metric 12⤵PID:3284
-
-
C:\Windows\SYSTEM32\netsh.exenetsh interface ipv4 set dnsservers "Ethernet" static 127.0.0.1 both > nul 2>&12⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1340
-
-
C:\Windows\SYSTEM32\netsh.exenetsh interface ipv4 set dnsservers "Loopback Pseudo-Interface 1" static 127.0.0.1 both > nul 2>&12⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2756
-
-
C:\Windows\SYSTEM32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:3384
-