Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
vgc_emu.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
vgc_emu.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target vgc_emu.exe
- Size 115KB
- Sample261104-tkf1csdy5q
- SHA256 9e8bb4170f627c0e98f94fe0b95dafc8afd36d2bcf612098213eb117c1e5b8fd
- MD5 8416a0bfda79815ff5e1702678058f7c
- SHA1 8daeaca9571ac30cc6b722dae0eaae115f0d32c3
- SHA512 22f18caaa8c7f241e4dda62f0072e890657cec09332992a24bb5497eaecd21ba25e101bedfebde3d17fd70c7ad59701f61f8d626f794b3417757313abd88839f
- SSDEEP 3072:Aqq3ARufdO8aTtfqMrkcZQnEs1P1oQtxL0tLd:AqbRufdO8aTtSgkcCnP1P1oYxL0t
- TLSH T1BCC35C27FA1510BDD269D578C9974A07DB73B8450750B7CB6BC05ED20E17AE8AF3EA00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2208 sc.exe 6132 sc.exe 4636 sc.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2620 cmd.exe 4236 cmd.exe 6080 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe 3752 vgc_emu.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3752 wrote to memory of 6080 3752 vgc_emu.exe 90 PID 6080 wrote to memory of 2208 6080 cmd.exe 91 PID 3752 wrote to memory of 2620 3752 vgc_emu.exe 92 PID 2620 wrote to memory of 6132 2620 cmd.exe 93 PID 3752 wrote to memory of 4236 3752 vgc_emu.exe 94 PID 4236 wrote to memory of 4636 4236 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\vgc_emu.exe"C:\Users\Admin\AppData\Local\Temp\vgc_emu.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop vgk >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\system32\sc.exesc stop vgk3⤵
- Launches sc.exe
PID:2208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\system32\sc.exesc stop vgc3⤵
- Launches sc.exe
PID:6132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\system32\sc.exesc start vgc3⤵
- Launches sc.exe
PID:4636
-
-