6f725207df4c65fe9da51300a6c36174d06a3d829487d1c8fdb8c3a32f1d92aa

Analysis

max time kernel
150s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
default.dat.exe
Size 13.6MB
Sample260708-1rdbdahv7m
SHA256 6f725207df4c65fe9da51300a6c36174d06a3d829487d1c8fdb8c3a32f1d92aa
MD5 b527467c5ecead21b1018905e2fb90df
SHA1 c9c86aa50f3d0ab44d3faac035143e0fddcf7d38
SHA512 8816ae71e1aba289ea8f3007cb161862f2f361c0a9d111c86e3ce18a49ed28f699526d2ebf137e6fdec048adea2aade0d49a740f3b53e8092afb5ba37558efe3
SSDEEP 393216:XWB4F5ulsoTB7dVSimxbXMCHWUjXQcuI3/PGTAI:GGlopdVSjxbXMb8XFH/O7
TLSH
T13CE63350A6F102FEF4A3917CEEA19590F29974621BB6CACF479483621E532F04D3E71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1396	powershell.exe
5928	powershell.exe
3096	powershell.exe
5488	powershell.exe
1856	powershell.exe
1304	powershell.exe
1544	powershell.exe
3820	powershell.exe
1100	powershell.exe
924	powershell.exe
2992	powershell.exe
2752	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe
5424	default.dat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5424	default.dat.exe
5424	default.dat.exe
924	powershell.exe
924	powershell.exe
2992	powershell.exe
2992	powershell.exe
2752	powershell.exe
2752	powershell.exe
1856	powershell.exe
1856	powershell.exe
1396	powershell.exe
1396	powershell.exe
5928	powershell.exe
5928	powershell.exe
1304	powershell.exe
1304	powershell.exe
3096	powershell.exe
3096	powershell.exe
1544	powershell.exe
1544	powershell.exe
5488	powershell.exe
5488	powershell.exe
3820	powershell.exe
3820	powershell.exe
1100	powershell.exe
1100	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5424	default.dat.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeIncreaseQuotaPrivilege	924	powershell.exe
Token: SeSecurityPrivilege	924	powershell.exe
Token: SeTakeOwnershipPrivilege	924	powershell.exe
Token: SeLoadDriverPrivilege	924	powershell.exe
Token: SeSystemProfilePrivilege	924	powershell.exe
Token: SeSystemtimePrivilege	924	powershell.exe
Token: SeProfSingleProcessPrivilege	924	powershell.exe
Token: SeIncBasePriorityPrivilege	924	powershell.exe
Token: SeCreatePagefilePrivilege	924	powershell.exe
Token: SeBackupPrivilege	924	powershell.exe
Token: SeRestorePrivilege	924	powershell.exe
Token: SeShutdownPrivilege	924	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeSystemEnvironmentPrivilege	924	powershell.exe
Token: SeRemoteShutdownPrivilege	924	powershell.exe
Token: SeUndockPrivilege	924	powershell.exe
Token: SeManageVolumePrivilege	924	powershell.exe
Token: 33	924	powershell.exe
Token: 34	924	powershell.exe
Token: 35	924	powershell.exe
Token: 36	924	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeIncreaseQuotaPrivilege	2992	powershell.exe
Token: SeSecurityPrivilege	2992	powershell.exe
Token: SeTakeOwnershipPrivilege	2992	powershell.exe
Token: SeLoadDriverPrivilege	2992	powershell.exe
Token: SeSystemProfilePrivilege	2992	powershell.exe
Token: SeSystemtimePrivilege	2992	powershell.exe
Token: SeProfSingleProcessPrivilege	2992	powershell.exe
Token: SeIncBasePriorityPrivilege	2992	powershell.exe
Token: SeCreatePagefilePrivilege	2992	powershell.exe
Token: SeBackupPrivilege	2992	powershell.exe
Token: SeRestorePrivilege	2992	powershell.exe
Token: SeShutdownPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeSystemEnvironmentPrivilege	2992	powershell.exe
Token: SeRemoteShutdownPrivilege	2992	powershell.exe
Token: SeUndockPrivilege	2992	powershell.exe
Token: SeManageVolumePrivilege	2992	powershell.exe
Token: 33	2992	powershell.exe
Token: 34	2992	powershell.exe
Token: 35	2992	powershell.exe
Token: 36	2992	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeIncreaseQuotaPrivilege	2752	powershell.exe
Token: SeSecurityPrivilege	2752	powershell.exe
Token: SeTakeOwnershipPrivilege	2752	powershell.exe
Token: SeLoadDriverPrivilege	2752	powershell.exe
Token: SeSystemProfilePrivilege	2752	powershell.exe
Token: SeSystemtimePrivilege	2752	powershell.exe
Token: SeProfSingleProcessPrivilege	2752	powershell.exe
Token: SeIncBasePriorityPrivilege	2752	powershell.exe
Token: SeCreatePagefilePrivilege	2752	powershell.exe
Token: SeBackupPrivilege	2752	powershell.exe
Token: SeRestorePrivilege	2752	powershell.exe
Token: SeShutdownPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeSystemEnvironmentPrivilege	2752	powershell.exe
Token: SeRemoteShutdownPrivilege	2752	powershell.exe
Token: SeUndockPrivilege	2752	powershell.exe
Token: SeManageVolumePrivilege	2752	powershell.exe
Token: 33	2752	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 5424	3200	default.dat.exe	88
PID 5424 wrote to memory of 4652	5424	default.dat.exe	89
PID 4652 wrote to memory of 924	4652	cmd.exe	91
PID 5424 wrote to memory of 5428	5424	default.dat.exe	93
PID 5428 wrote to memory of 2992	5428	cmd.exe	95
PID 5424 wrote to memory of 5812	5424	default.dat.exe	96
PID 5812 wrote to memory of 2752	5812	cmd.exe	98
PID 5424 wrote to memory of 4480	5424	default.dat.exe	99
PID 4480 wrote to memory of 1856	4480	cmd.exe	101
PID 5424 wrote to memory of 2228	5424	default.dat.exe	102
PID 2228 wrote to memory of 1396	2228	cmd.exe	104
PID 5424 wrote to memory of 2372	5424	default.dat.exe	105
PID 2372 wrote to memory of 5928	2372	cmd.exe	107
PID 5424 wrote to memory of 2864	5424	default.dat.exe	108
PID 2864 wrote to memory of 1304	2864	cmd.exe	110
PID 5424 wrote to memory of 2820	5424	default.dat.exe	111
PID 2820 wrote to memory of 3096	2820	cmd.exe	113
PID 5424 wrote to memory of 4948	5424	default.dat.exe	114
PID 4948 wrote to memory of 1544	4948	cmd.exe	116
PID 5424 wrote to memory of 1540	5424	default.dat.exe	117
PID 1540 wrote to memory of 5488	1540	cmd.exe	119
PID 5424 wrote to memory of 1428	5424	default.dat.exe	120
PID 1428 wrote to memory of 3820	1428	cmd.exe	122
PID 5424 wrote to memory of 5820	5424	default.dat.exe	124
PID 5820 wrote to memory of 1100	5820	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\default.dat.exe
"C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\default.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\default.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\mikameta'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\mikameta'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact